TeamFiltration Campaign Compromises Seven Microsoft 365 Accounts Using Default Passwords

The UNK_CondorFiltration campaign, leveraging the TeamFiltration framework, conducted brute-force attacks against Microsoft 365 accounts across 28 tenants, primarily targeting Chilean financial and retail organizations. The attackers exploited unmanaged service accounts with default or unrotated passwords and no multi-factor authentication, compromising seven accounts. Six of the seven breaches occurred within seven minutes of each other, suggesting shared credentials. Post-compromise, the threat actor used German VPN nodes to access corporate resources including Azure Portal, SharePoint Online, and Microsoft Graph API.

AI-extracted · verify before operational use