Cybersecurity
TeamFiltration campaign compromised seven Microsoft 365 accounts
Proofpoint said a TeamFiltration-linked campaign against Microsoft 365 tenants in Chile used default passwords and neglected service accounts, leading to seven compromises during an August wave after earlier spraying attempts.
- Proofpoint said the campaign codenamed UNK_CondorFiltration targeted more than 5,700 accounts across 28 Microsoft 365 tenants.
- It said the activity mainly affected Chilean retail and financial organisations and came from 1,487 unique AWS EC2 source IP addresses.
- Proofpoint said seven compromised accounts were unmanaged service or functional accounts with default or unrotated passwords and no multifactor authentication.
- The campaign was reported as three waves between late July and August 2026, with the final wave against a Chilean retailer producing the seven compromises.
- Proofpoint said six of the seven accounts were taken over within seven minutes.
Proofpoint said the activity it tracked as UNK_CondorFiltration was an active TeamFiltration campaign against Microsoft 365 tenants. It said the operation focused mainly on Chilean retail and financial organisations and used 1,487 unique AWS EC2 source addresses.
The firm described three waves. The first ran from 21 to 24 July and focused on two large Chilean banks, the second ran from 26 to 28 July and peaked on 27 July, and the third ran from 13 to 16 August and was aimed at a large Chilean retailer.
Proofpoint said the actor appeared to have used default passwords, including ones set up by IT staff and never changed. It said the successful breaks were all against service or functional accounts that had not been monitored and did not use multifactor authentication.
The company said six of the seven accounts were accessed within seven minutes, which it said pointed to a shared or default password rather than individual targeting. After compromise, the operator was seen using Office, OneDrive and Teams, and later probing a VPN, Azure Portal, SharePoint Online and Microsoft Graph API tokens.
Proofpoint said TeamFiltration is a legitimate cross-platform offensive framework for enumerating, spraying, exfiltrating and backdooring Entra ID accounts. It also compared the campaign with its June 2025 disclosure of UNK_SneakyStrike, which it said used TeamFiltration against more than 80,000 accounts.
Named in this story
Companies
- Proofpoint
- issued the disclosure and attributed the activity to TeamFiltration
Organisations
- UNK_CondorFiltration
- the campaign name Proofpoint gave the activity
- UNK_SneakyStrike
- the earlier Proofpoint-dubbed threat cluster that used TeamFiltration
Products and systems
- TeamFiltration
- the offensive framework used in the campaign
- Microsoft 365
- the cloud service targeted across 28 tenants
- AWS EC2
- the source of the observed IP addresses
- Entra ID
- the identity system TeamFiltration was designed to target
- Microsoft Office
- one of the services accessed after compromise
- OneDrive
- one of the services accessed after compromise
- Teams
- one of the services accessed after compromise
- Azure Portal
- one of the services the operator opened after compromise
- SharePoint Online
- one of the services the operator browsed after compromise
- Microsoft Graph API
- the API for which token requests were initiated
How the source tells it
The piece was mostly a straight incident report, with a warning-led register in Proofpoint's own description of the exposure.
- alarm relies on Proofpoint’s warning language about a critical exposure gap and compromised accounts
- moral framing casts forgotten service accounts as the weak link by contrasting them with phished employees and zero-day exploits