Cybersecurity researchers have disclosed details of an active **TeamFiltration** campaign codenamed **UNK_CondorFiltration** that has targeted over 5,700 accounts across 28 **Microsoft 365** tenants.  According to **Proofpoint**, the activity has primarily focused on Chilean retail and financial institutions. It originated from 1,487 unique **AWS EC2** source IP addresses. "The campaign compromised 7 accounts – all of which were unmanaged functional or service accounts rather than individual employee accounts – highlighting a critical exposure gap around forgotten, non-human identities carrying default or unrotated passwords and no MFA [multi-factor authentication]," the enterprise security company said in a statement. ### Campaign Waves and Targets The **Microsoft 365** brute-force campaign unfolded across three different waves from late July to August. An unnamed Chilean retailer faced the brunt of 78.3% of all observed authentication events. * **July 21-24:** Targeted approximately 100–120 unique accounts per day, directed against two major Chilean banking institutions. * **July 26-28:** Targeted a peak of about 1,520 accounts on July 27 before dropping sharply, directed against another major Chilean financial institution. * **August 13-16:** Targeted a peak of about 1,560 accounts on August 15 and directed against a major Chilean retailer, leading to seven account compromises. ### Exploiting Dormant Service Accounts Evidence indicates that the threat actor likely sprayed accounts with default passwords, including credentials provisioned by IT teams and never rotated. The activity mainly targeted dormant service accounts as opposed to personal employee accounts, as users are typically mandated to change passwords periodically. These service accounts, per **Proofpoint**, were provisioned to run business operations and then left unmonitored, while still carrying their original credentials. Every successful compromise has been linked to unmonitored service accounts with a default password. Six of the seven compromised accounts were broken into within 7 minutes, likely indicating a shared or default password set rather than individually targeted credential stuffing. ### The Role of TeamFiltration The activity is characterized by the use of **TeamFiltration**, a legitimate cross-platform offensive framework designed for "enumerating, spraying, exfiltrating, and backdooring" **Entra ID** accounts. It allows an operator to validate email accounts, test common or targeted passwords across enumerated accounts, harvest sensitive data, and gain covert, interactive access to **OneDrive**. Across most of the compromised accounts, the threat actor leveraged the foothold to access **Microsoft Office**, **OneDrive**, and **Teams**, potentially indicative of data harvesting and exfiltration. That said, sign-in events alone cannot be taken as definitive evidence of exfiltration. Less than 2 minutes after successful compromise, the operator has been observed pivoting to a German VPN node to probe the corporate VPN, access **Azure Portal**, browse **SharePoint Online**, and initiate **Microsoft Graph API** token requests. ### A Recurring Threat This is not the first time **TeamFiltration** has been put to use in malicious attacks. In June 2025, **Proofpoint** detailed another threat cluster dubbed **UNK_SneakyStrike** that targeted over 80,000 user accounts across hundreds of organizations' cloud tenants using the open-source penetration testing framework. "The **UNK_CondorFiltration** campaign is a reminder that one of the weakest links in an enterprise identity perimeter is often not a phished employee or a zero-day exploit," **Proofpoint** stated. "It is the forgotten account. Service accounts provisioned for convenience and never revisited are a structurally unprotected attack surface."