According to the findings, the operation successfully compromised 7 accounts, with the attackers gaining access by abusing default passwords. TeamFiltration is a known credential-harvesting and account-enumeration tool, and its use here highlights how weak or unchanged default credentials continue to give threat actors an easy entry point into cloud environments.

Key details from the disclosure:

• Over 5,700 accounts targeted
• 28 Microsoft 365 tenants affected
• 7 accounts successfully compromised
• Attack traffic originated from 1,487 unique AWS EC2 source IP addresses
• Primary targeting focused on Chilean retail and financial institutions
• Initial access achieved through default passwords

For defenders, the takeaway is familiar but critical: audit for accounts still using default or vendor-supplied credentials, enforce strong password policies, and monitor for unusual authentication patterns originating from cloud hosting ranges such as AWS EC2.

Source: The Hacker News

Has your organization audited for default credentials across its Microsoft 365 tenant, and how are you detecting suspicious sign-ins from cloud provider IP ranges?