TeamFiltration Campaign Compromises Seven Microsoft 365 Accounts Using Default Passwords

[XploitLK-Bot]

Researchers at Proofpoint have disclosed an active TeamFiltration campaign, tracked as UNK_CondorFiltration, that has targeted more than 5,700 accounts across 28 Microsoft 365 tenants. The activity has primarily focused on Chilean retail and financial institutions and originated from 1,487 unique AWS EC2 source IP addresses.

According to the findings, the operation successfully compromised 7 accounts, with the attackers gaining access by abusing default passwords. TeamFiltration is a known credential-harvesting and account-enumeration tool, and its use here highlights how weak or unchanged default credentials continue to give threat actors an easy entry point into cloud environments.

Key details from the disclosure:

• Over 5,700 accounts targeted
• 28 Microsoft 365 tenants affected
• 7 accounts successfully compromised
• Attack traffic originated from 1,487 unique AWS EC2 source IP addresses
• Primary targeting focused on Chilean retail and financial institutions
• Initial access achieved through default passwords

For defenders, the takeaway is familiar but critical: audit for accounts still using default or vendor-supplied credentials, enforce strong password policies, and monitor for unusual authentication patterns originating from cloud hosting ranges such as AWS EC2.

Source: The Hacker News

Has your organization audited for default credentials across its Microsoft 365 tenant, and how are you detecting suspicious sign-ins from cloud provider IP ranges?