Full Report
Cybersecurity researchers have disclosed details of an active TeamFiltration campaign codenamed UNK_CondorFiltration that has targeted over 5,700 accounts across 28 Microsoft 365 tenants. According to Proofpoint, the activity has primarily focused on Chilean retail and financial institutions. It originated from 1,487 unique AWS EC2 source IP addresses. "The campaign compromised 7 accounts –
Analysis Summary
# Incident Report: UNK_CondorFiltration Campaign
## Executive Summary
The UNK_CondorFiltration campaign, utilizing the TeamFiltration framework, targeted over 5,700 Microsoft 365 accounts across 28 tenants, primarily focusing on Chilean financial and retail sectors. The attackers successfully compromised seven unmanaged service accounts by exploiting default passwords and a lack of Multi-Factor Authentication (MFA). The incident highlights a critical security gap in "forgotten" non-human identities that maintain persistent access to corporate cloud environments.
## Incident Details
- **Discovery Date:** September 2026 (Reported by Proofpoint)
- **Incident Date:** July 21, 2026 – August 16, 2026
- **Affected Organization:** Multiple (including major Chilean banking institutions and a large retailer)
- **Sector:** Financial and Retail
- **Geography:** Chile (Targeted), Germany (VPN pivot), AWS EC2 (Source infrastructure)
## Timeline of Events
### Initial Access
- **Date/Time:** July 21 – August 16, 2026
- **Vector:** Brute-force / Password Spraying
- **Details:** Attackers targeted service accounts using the TeamFiltration framework to spray common and default passwords.
### Lateral Movement
- **Pivot:** Within 2 minutes of compromise, the threat actor pivoted to a German VPN node to probe the corporate VPN (`vpn.[redacted].cl/SAML20/SP`).
- **Cloud Pivot:** Accessed the Azure Portal and initiated Microsoft Graph API token requests to broaden access.
### Data Exfiltration/Impact
- **Access:** Unauthorized access to Microsoft Office 365, OneDrive, and Teams.
- **Harvesting:** Probing of SharePoint Online and OneDrive for sensitive data.
### Detection & Response
- **Discovery:** Identified by Proofpoint researchers tracking the TeamFiltration framework activity.
- **Response Actions:** Details on specific remediation by the affected organizations were not disclosed in the report, though Proofpoint disseminated the findings to alert the security community.
## Attack Methodology
- **Initial Access:** Password spraying against Microsoft 365 tenants.
- **Persistence:** Generation of Microsoft Graph API tokens.
- **Privilege Escalation:** Not explicitly stated, though service accounts often hold elevated permissions.
- **Defense Evasion:** Use of 1,487 unique AWS EC2 source IPs to bypass rate-limiting/IP reputation filtering; pivoting to localized German VPN nodes.
- **Credential Access:** Targeting unmanaged service accounts with default/unrotated passwords.
- **Discovery:** Account enumeration and email validation using TeamFiltration.
- **Lateral Movement:** Accessing Azure Portal and corporate VPN endpoints via SAML.
- **Collection:** Browsing SharePoint Online and OneDrive.
- **Exfiltration:** Potential data harvesting via Microsoft Graph API.
- **Impact:** Unauthorized access and potential data exposure of corporate cloud environments.
## Impact Assessment
- **Financial:** Unknown; potential for high impact given the targeting of banking institutions.
- **Data Breach:** Exposure of OneDrive and Teams data for seven compromised service accounts.
- **Operational:** Minimal disruption reported, but high risk of long-term espionage or subsequent ransomware.
- **Reputational:** Significant risk to Chilean financial institutions and retailers.
## Indicators of Compromise
- **Network Indicators:**
- Source traffic originating from AWS EC2 infrastructure (approx. 1,487 IPs).
- German VPN nodes used for post-compromise activity.
- `vpn.[redacted].cl/SAML20/SP`
- **Behavioral Indicators:**
- Rapid login to Azure Portal/Microsoft Graph API within <2 minutes of successful authentication.
- High-volume authentication events (up to 1,560 accounts targeted per day).
- Successful logins on dormant service accounts that have no recorded human activity.
## Response Actions
- **Containment:** Organizations advised to identify and disable compromised service accounts.
- **Eradication:** Revocation of Microsoft Graph API tokens and mandatory password rotations.
- **Recovery:** Auditing of OneDrive and SharePoint logs to determine the extent of data accessed.
## Lessons Learned
- **The "Forgotten Account" Risk:** Service accounts are frequently overlooked in security audits and often lack the stringent MFA requirements applied to human users.
- **Default Passwords:** IT-provisioned accounts that do not require a password change upon first login remain a top-tier vulnerability.
- **Framework Dual-Use:** Legitimate offensive security tools (TeamFiltration) continue to be weaponized effectively by threat actors.
## Recommendations
- **Implement MFA for ALL accounts:** Ensure Multi-Factor Authentication is enforced for service and functional accounts, or use Managed Identities where possible.
- **Password Hygiene:** Enforce password rotation policies and eliminate the use of default credentials for automated accounts.
- **Identity Governance:** Conduct regular audits of "dormant" or service accounts to ensure they are still necessary and secure.
- **Monitoring:** Set alerts for successful logins from unusual geographic locations (e.g., German VPN nodes) or AWS IP ranges.