TeamFiltration Attacks Breach Microsoft 365 Cloud Accounts

Executive Summary

Enterprise cybersecurity researchers at Proofpoint have uncovered an active cyber espionage and cloud account takeover campaign tracked as UNK_CondorFiltration. The threat cluster weaponized TeamFiltration—an open-source cross-platform offensive security framework designed for Microsoft Entra ID (formerly Azure AD) enumeration, credential spraying, and exfiltration—targeting more than 5,700 user accounts across 28 distinct Microsoft 365 enterprise tenants.

The intrusion apparatus primarily targeted major commercial retail and financial institutions in South America, with a single Chilean retail conglomerate bearing 78.3% of all observed authentication events. The campaign successfully breached seven enterprise cloud accounts across multiple corporate tenants.

Critically, all seven compromised identities were unmanaged, functional service accounts rather than individual employee identities. These non-human accounts had been provisioned by IT administrators to handle background business workflows and subsequently left unmonitored—carrying unrotated default credentials with zero Multi-Factor Authentication (MFA) enforcement.

Technical Vulnerability Analysis & Attack Chain

The campaign unfolded across three major operational waves from late July to August 2026, executing a highly efficient cloud identity kill chain:

1. Distributed AWS EC2 Password Spraying: The operators deployed an infrastructure cluster spanning 1,487 unique AWS EC2 IP addresses. By rotating connection pools across cloud compute instances, the attackers bypassed Microsoft Entra ID Smart Lockout protections and avoided IP-based perimeter rate limits while enumerating valid corporate email addresses.
2. Default Credential Exploitation: Rather than broad credential stuffing from third-party breaches, the threat actors sprayed targeted wordlists consisting of IT default passwords commonly assigned during initial account provisioning. Because service accounts are typically excluded from mandatory periodic password reset cycles, the original default passwords remained active indefinitely.
3. Rapid Ingress Without MFA: Six of the seven compromised accounts were successfully breached within a 7-minute window, confirming that the adversary possessed a uniform default password set. Because IT teams had excluded these functional identities from Conditional Access MFA policies for operational convenience, the logins succeeded on first attempt with zero challenge prompts.
4. Immediate VPN Pivoting: In under two minutes following each successful account takeover, the operator transitioned from the AWS spraying cluster to a dedicated commercial VPN node located in Germany. From this European egress point, the attacker initiated reconnaissance against the victim's corporate VPN portal (vpn.[victim].cl/SAML20/SP), seeking SSO federation pathways.
5. Microsoft Graph API & SharePoint Exfiltration: Once inside the cloud tenant, the actor accessed Microsoft Office 365 services—including SharePoint Online, OneDrive, and Microsoft Teams. The attacker requested Microsoft Graph API authentication tokens, enabling automated programmatic querying of corporate directories, sensitive internal document stores, and financial records.

MITRE ATT&CK Tactics, Techniques & Procedures (TTPs)

Threat Actor Profile & Campaign Attribution

Proofpoint tracks the threat cluster under the temporary designation UNK_CondorFiltration. The tactical employment of TeamFiltration represents a continuing trend of threat actors adopting open-source dual-use offensive frameworks to blend in with legitimate security assessments.

This activity follows an earlier campaign documented in June 2025, codenamed UNK_SneakyStrike, which compromised over 80,000 accounts across hundreds of enterprise tenants using identical TeamFiltration tooling. The focus on Chilean retail and financial conglomerates indicates either regional financially motivated cybercrime actors conducting business email compromise (BEC) and corporate espionage, or initial access brokers staging cloud beachheads for secondary monetization.

Detection & SOC Mitigation Playbook

1. Patch & Workaround Guidance

• Mandatory Non-Human Identity MFA: Reconfigure Microsoft Entra ID Conditional Access policies to mandate Multi-Factor Authentication (or FIDO2 / Certificate-Based Authentication) across all accounts, strictly forbidding global MFA exemptions for service or functional identities.
• Service Account Inventory & Deprecation: Deploy Entra ID Identity Governance or automated PowerShell auditing scripts to discover dormant non-human accounts that have not logged in for 90+ days. Deprecate unused accounts and migrate active workloads to Managed Identities or Service Principals with certificate credentials rather than static passwords.
• Enforce Custom Banned Password Lists: Ingest enterprise-specific default password schemes (e.g. Company2026!, Welcome123) into Microsoft Entra Password Protection to prevent administrators from provisioning easily guessable default credentials.

2. Network & Perimeter Defenses

• Implement Entra ID Conditional Access location policies blocking interactive sign-ins originating from cloud hosting providers (AWS, DigitalOcean, Hetzner) and known commercial VPN exit relays.
• Configure automated alerts in Microsoft Sentinel or Defender for Cloud Apps for Impossible Travel and Atypical Travel, specifically alerting when an authentication event from a domestic IP is followed by a session from a foreign VPN exit point within minutes.
• Restrict Microsoft Graph API permissions granted to user and service accounts, ensuring non-administrative accounts cannot generate high-privilege directory read tokens.

3. Endpoint Detection & Hunting Query

title: TeamFiltration User-Agent or Distributed AWS EC2 Password Spray
id: 5d2c8a14-9e7b-4f10-9012-3456789abcde
status: experimental
description: Detects sign-in attempts exhibiting TeamFiltration default User-Agent signatures or rapid sequential authentications across AWS IP space.
author: CyberNewsAI Threat Intelligence
references:
  - https://thehackernews.com/2026/09/teamfiltration-compromises-seven.html
tags:
  - attack.t1110.003
  - attack.t1078.004
logsource:
  category: signin_logs
  product: azure
detection:
  selection_agent:
    UserAgent|contains:
      - 'TeamFiltration'
      - 'python-requests'
      - 'Go-http-client'
  selection_spray:
    AppId: '00000002-0000-0ff1-ce00-000000000000' # Office 365 Exchange Online
    ResultType: '50126' # Invalid username or password
  condition: selection_agent or selection_spray
falsepositives:
  - Internal red team authorized penetration tests simulating cloud identity brute-forcing
level: high

// Microsoft Sentinel / Defender Hunting Query: Detect Anomalous Cloud Sign-ins on Unmanaged Service Accounts Followed by Fast VPN Shift
SigninLogs
| where TimeGenerated > ago(7d)
| where UserPrincipalName has_any ("svc", "service", "admin", "backup", "scan", "printer", "functional")
| where ResultType == 0 // Successful sign-in
| extend ClientIP = IPAddress, Country = tostring(LocationDetails.countryOrRegion)
| project TimeGenerated, UserPrincipalName, AppDisplayName, ClientIP, Country, UserAgent, AuthenticationRequirement
| summarize Count = count(), Countries = make_set(Country), IPs = make_set(ClientIP) by UserPrincipalName, bin(TimeGenerated, 1h)
| where array_length(Countries) > 1 or array_length(IPs) > 2
| sort by TimeGenerated desc

Infrastructure & Network Telemetry

Compromised Identity Characteristics