/
← Voltar ao feed
high retail financial

UNK_CondorFiltration TeamFiltration campaign sprays 5,700+ Microsoft 365 accounts at Chilean retail and finance, compromising 7 service accounts

1 fonte(s) · 1 atualização(ões) · publicado 24/09/2026 13:16 · coletado há 4 dias

Proofpoint disclosed an active campaign, tracked as UNK_CondorFiltration, that used the TeamFiltration offensive framework against more than 5,700 accounts across 28 Microsoft 365 tenants. It focused mainly on Chilean retail and financial institutions and originated from 1,487 unique AWS EC2 IP addresses. Seven accounts were compromised, all of them unmanaged functional or service accounts with default or unrotated passwords and no MFA. The activity ran in three waves between late July and August 2026, and an unnamed Chilean retailer received 78.3% of all observed authentication events.

Detalhes técnicos

  • Wave 1 (July 21-24): about 100-120 unique accounts per day, aimed at two major Chilean banks.
  • Wave 2 (July 26-28): peak of about 1,520 accounts on July 27, aimed at another major Chilean financial institution.
  • Wave 3 (August 13-16): peak of about 1,560 accounts on August 15, aimed at a major Chilean retailer. This wave produced all seven compromises.
  • The actor likely sprayed default passwords provisioned by IT and never rotated. Six of the seven accounts fell within 7 minutes, which suggests a shared or default password set rather than targeted credential stuffing.
  • TeamFiltration is a legitimate cross-platform framework for enumerating, spraying, exfiltrating and backdooring Entra ID accounts. It can also give interactive access to OneDrive.
  • After compromise, the actor accessed Office, OneDrive and Teams, which may indicate data harvesting. Sign-in events alone do not prove exfiltration.
  • Within 2 minutes of a compromise, the operator pivoted through a German VPN node. From there it probed the corporate VPN SAML endpoint, accessed Azure Portal, browsed SharePoint Online and requested Microsoft Graph API tokens.
  • Proofpoint previously tracked UNK_SneakyStrike (June 2025), which used TeamFiltration against more than 80,000 accounts.

Remediação

  • Inventory dormant and non-human service accounts, and rotate default or unrotated credentials.
  • Enforce MFA or conditional access on service accounts where feasible, and monitor them for sign-in anomalies.
  • Hunt for password-spraying patterns, AWS EC2-origin authentication, and Graph API token requests that follow sign-ins within minutes.

Linha do tempo

  1. proofpoint.com ↗ · pub. 24/09/2026 13:16 · coletado 19/10 18:02 primeiro registro

    UNK_CondorFiltration TeamFiltration campaign sprays 5,700+ Microsoft 365 accounts at Chilean retail and finance, compromising 7 service accounts

    ler a análise desta fonte

    Proofpoint disclosed an active campaign, tracked as UNK_CondorFiltration, that used the TeamFiltration offensive framework against more than 5,700 accounts across 28 Microsoft 365 tenants. It focused mainly on Chilean retail and financial institutions and originated from 1,487 unique AWS EC2 IP addresses. Seven accounts were compromised, all of them unmanaged functional or service accounts with default or unrotated passwords and no MFA. The activity ran in three waves between late July and August 2026, and an unnamed Chilean retailer received 78.3% of all observed authentication events.

    Technical Details

    • Wave 1 (July 21-24): about 100-120 unique accounts per day, aimed at two major Chilean banks.
    • Wave 2 (July 26-28): peak of about 1,520 accounts on July 27, aimed at another major Chilean financial institution.
    • Wave 3 (August 13-16): peak of about 1,560 accounts on August 15, aimed at a major Chilean retailer. This wave produced all seven compromises.
    • The actor likely sprayed default passwords provisioned by IT and never rotated. Six of the seven accounts fell within 7 minutes, which suggests a shared or default password set rather than targeted credential stuffing.
    • TeamFiltration is a legitimate cross-platform framework for enumerating, spraying, exfiltrating and backdooring Entra ID accounts. It can also give interactive access to OneDrive.
    • After compromise, the actor accessed Office, OneDrive and Teams, which may indicate data harvesting. Sign-in events alone do not prove exfiltration.
    • Within 2 minutes of a compromise, the operator pivoted through a German VPN node. From there it probed the corporate VPN SAML endpoint, accessed Azure Portal, browsed SharePoint Online and requested Microsoft Graph API tokens.
    • Proofpoint previously tracked UNK_SneakyStrike (June 2025), which used TeamFiltration against more than 80,000 accounts.

    Remediation

    • Inventory dormant and non-human service accounts, and rotate default or unrotated credentials.
    • Enforce MFA or conditional access on service accounts where feasible, and monitor them for sign-in anomalies.
    • Hunt for password-spraying patterns, AWS EC2-origin authentication, and Graph API token requests that follow sign-ins within minutes.