TeamFiltration Brute-Force Campaign Compromises Microsoft 365 Service Accounts

What Happened

Security researchers have detailed a targeted brute-force campaign codenamed UNK_CondorFiltration, which leveraged nearly 1,500 unique AWS EC2 IP addresses to assault Microsoft 365 tenants. The activity spanned three distinct operational waves between late July and mid-August 2026, primarily focusing on financial and retail organizations in Chile. Attackers executed credential-spraying techniques against more than 5,700 accounts.

Impact

The campaign resulted in the successful compromise of seven Microsoft 365 accounts. Notably, all compromised entities were unmanaged functional or service accounts rather than individual employee profiles. Investigators found that six of the seven accounts were breached within seven minutes of the attack wave, pointing to the use of static, non-rotated default credentials assigned during initial provisioning.

Every successful compromise has been linked to unmonitored service accounts with a default password.

What to Defend

Defenders and system administrators managing cloud identity providers must audit tenant environments for unmonitored non-human identities. Key remediation steps include:

• Enforce mandatory multi-factor authentication (MFA) across all functional, service, and administrative accounts without exception.
• Implement strict password rotation policies for non-human identities to eliminate static, vendor-supplied default credentials.
• Monitor sign-in logs for high-velocity authentication attempts originating from cloud hosting provider IP ranges such as AWS EC2.
• Identify and disable dormant or orphaned service accounts that are no longer required for active business operations.