CrowdStrike published an account on 29 October 2026 of a China-nexus actor it tracks as VAPOR PANDA using ARTEX, a multi-agent penetration testing framework, against more than 200 organisations beginning 17 October, with post-exploitation confirmed at nine of them (CrowdStrike). Eight days earlier Microsoft assessed that a separate actor running the same framework was responsible for the compromise of a backup vendor's multi-tenant application, and used its stolen application identities to reach downstream Microsoft 365 customer tenants (Microsoft). If you administer cloud identity, authorise third party applications into a Microsoft 365 tenant, or run security monitoring for a manufacturing, semiconductor, pharmaceutical, telecommunications or energy organisation, both reports are addressed to you.

If a ConnectWise Cloud Backup application is authorised in a Microsoft 365 tenant you manage

ConnectWise's incident page states that it identified unauthorised access to application identities within its Cloud Backup environment and shut off that application access (ConnectWise, update of 17 October 2026, read 6 November 2026). In scope is any Microsoft 365 tenant, your own or a customer's, where a ConnectWise Cloud Backup application is or was authorised; it also took its SaaS Security and Cloud Management services offline as a precaution. Its steps, in its order: keep affected application connections disabled until it gives instructions that apply to your service, in its 27 October wording; review your own tenant and each customer tenant against its technical investigation and remediation guide, which covers Entra ID sign-in logs filtered to the affected application ID and any permission or credential changes; coordinate with your security team or provider; and report suspicious activity to the address it gives. Re-authorisation runs through a new application once it tells partners to proceed, per its 28 October update, the most recent on that incident page as of 6 November 2026.

What the reports describe

CrowdStrike watched one ARTEX controller over an 11-day window, driving intrusions in at least 14 countries. Nine organisations are confirmed at post-exploitation, where the actor deployed the BLOODALCHEMY backdoor and ran follow-on credential spraying and reconnaissance; at least 12 more saw password spraying or credential scanning. It ran mainly on DeepSeek, with planning agents in one intrusion consuming "on the order of 1.4 billion input tokens", and a human in the loop at decision points. The 200-plus figure counts targets, not victims.

CrowdStrike lists unsigned SAML assertions chained with an XML external entity flaw to query a cloud metadata service and reach administrative roles, an unauthenticated orchestration service that yielded root in a container environment, LAPS password reads, constrained delegation used for impersonation, a forged mail server administrator token built from a 2022 directory export whose keys were likely never rotated, and a VPN client key from a 2024 email leak.

Google Threat Intelligence Group and Mandiant published their account on 30 October, reporting that since late August 2026 they have seen threat actors operating ARTEX and comparable open source multi-agent platforms inside Mandiant incident response engagements, in several cases handed credentials the operators already held. CrowdStrike states that its own campaign is separate from the Storm-0940 ARTEX activity. GTIG's assessment: "the mechanics of the intrusions remain the same, such as using compromised credentials and targeting unpatched systems" (Google Threat Intelligence Group).

What this means if you administer cloud identity or authorise vendor applications

Neither report describes a new weakness. Signing keys likely never rotated since a 2022 export, a client key leaked in 2024, a delegation setting, a readable LAPS password, an orchestration service with no authentication: each was a standing condition before any agent arrived. What changed is the cost of finding and chaining them.

The consequence that lands first is timing. Microsoft reports multiple instances in which privileged cloud access followed in less than 3 hours, and GTIG timed execution in bursts of roughly 2 to 25 seconds, one of them 27 events in 23 seconds. A control that assumes somebody will read an alert, open a ticket and reach a colleague before the next stage begins was never sized for that. GTIG separates the functions it rests on: "Detection and disruption/response are two different functions".

Noise cuts the other way: GTIG counted 240 log events from one web server interaction, detectable if something collects it. We looked at the laboratory end in October.

Application identities are why the backup application case sits apart from the espionage campaign. An application with standing consent holds a token, and a token meets no password prompt and no multi-factor challenge. ConnectWise says disabling the applications does not reverse changes already made inside a tenant, and Microsoft says "[t]he presence of an affected application, or even successful authentication, does not necessarily indicate unauthorized data access or data exfiltration". Both point the work one way: a sweep for what was added, consented or assigned, not a look at sign-ins.

What to do if you administer Microsoft 365, Entra or cloud IAM

Now

  • If a ConnectWise Cloud Backup application is or was authorised in a tenant you manage, ConnectWise's own steps are in the section above.
  • Microsoft's caution comes first: do not delete the enterprise applications as a first response, preserve configuration and evidence, and do not hold up containment while exports run (Microsoft, read 6 November 2026).
  • Scope check, per Microsoft: review every Microsoft 365 tenant where the affected application IDs it lists are or were installed or authorised, even if unused, searching by application ID rather than display name. Then review activity from at least 15 October 2026, extending service principal sign-in review to 1 October where records allow.
  • Then, per Microsoft, read the Entra audit trail for credential additions, new applications or owners, app role assignments, consent grants, privileged role assignments and changes to authentication methods or Conditional Access. Rotate credentials and revoke unnecessary permissions where activity is confirmed suspicious, then have an authorised responder remove what is unauthorised. An empty result from its hunting query "should not be treated as confirmation that no access occurred".

This week

  • Microsoft's wider guidance: least privilege on multi-tenant application permissions and consent grants, monitoring of credential additions, privilege assignments and anomalous application-only activity, and verification that the rotation and remediation removed all unauthorised access (Microsoft).
  • CrowdStrike is a security vendor here rather than an authority, and its list runs in this order: rotate signing, preauthentication and service credentials after any suspected exposure, including those in historical backups and exports; enforce SAML signature validation and require IMDSv2; hunt for command lines containing artx or artex; patch internet-facing appliances; and run a real-time endpoint sensor everywhere (CrowdStrike).
  • Our recommendation: produce the sensor coverage gap list first, because CrowdStrike records the operator telling the agents to find Windows machines without its sensor and steering activity there.

Plan

  • Mandiant's layers, as that firm's recommendation, in its order: protect the control plane; restrict identities and keys, shortening lifetime and narrowing permissions; harden configurations to remove attack paths; rate-limit high-impact functions; and detect behavioural and volumetric change against a pattern (Google Threat Intelligence Group).
  • Our recommendation: write the baseline that last layer assumes, since detection of that kind fires on deviation from a documented pattern and nothing else: which identity may call which API, which host may reach which egress destination. The new ATT&CK detection strategies carry the same prerequisite, covered here.
  • Our recommendation: keep a register of every multi-tenant application holding standing consent, what it may read, and when the party holding its credentials last rotated them. Microsoft's search by application ID assumes such a list.

If you are not affected

ConnectWise's guidance addresses partners with affected Cloud Backup application connections, and Microsoft's scope is tenants where the application IDs it lists are or were installed or authorised. A tenant that has never had one of them authorised sits outside both conditions, and there may be nothing further to do there. There is also no patch to chase: no CVE is named for this activity in anything we opened, and nothing in CISA's Known Exploited Vulnerabilities catalog covers it at version 2026.11.04 (KEV catalog feed, read 6 November 2026). The hardening still earns its place, because GTIG, Microsoft and CrowdStrike each describe unconnected actors reaching for the same framework.

Where the constraint is whether telemetry on identities and vendor applications reaches somebody able to act inside the window these frameworks compress, that is what our 24/7 SOC and managed OT SOC carry.