Skip to navigation

Threat reportCloud SecurityTL-2026-2616

TeamFiltration Returns: UNK_CondorFiltration Credential-Spraying Campaign Targets Dormant M365 Service Accounts in Latin America

highACTIVE

Proofpoint identified a renewed campaign, tracked as UNK_CondorFiltration, using the open-source TeamFiltration offensive framework to credential-spray 28 Microsoft 365 tenants across Latin America, concentrated on Chilean retail and financial-sector organizations. Over 5,714 accounts were targeted across three waves between July 21 and August 16, 2026, resulting in 7 confirmed compromises of dormant, unmanaged service accounts lacking MFA, followed by post-compromise reconnaissance and attempted exfiltration of email, Teams chats, and OneDrive/SharePoint data.

Key facts

IdentifiersTL-2026-2616
Also known asSpraying in the Andes
SeverityHIGH
Affected productsMicrosoft Microsoft 365 / Entra ID
Weaknesses (CWE)CWE-1392, CWE-521, CWE-307
AttributionUNK_CondorFiltration (low confidence)
ToolsFireProx, TeamFiltration
MITRE ATT&CK techniquesT1036 Masquerading, T1078.004 Cloud Accounts, T1087.004 Cloud Account, T1090.002 External Proxy, T1110.003 Password Spraying, T1114.002 Remote Email Collection, T1119 Automated Collection, T1133 External Remote Services, T1213 Data from Information Repositories, T1213.002 Data from Information Repositories, T1526 Cloud Service Discovery, T1528 Steal Application Access Token and 6 more in the attack flow
MotivationUNKNOWN
Target sectorsretail, finance
Target regionsLatin America, chile
Detection rules9 (1 shown free)
Sources9 cited sources

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2616 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: TeamFiltration Teams-API Enumeration & Password-Spray Burst Against M365 Sign-Ins

Detects the TeamFiltration enumeration/spray phase: a burst of authentication events against many distinct M365/Entra ID accounts from AWS EC2-hosted source IPs (3.101.0.0/16, 18.144.76.0/24, 13.52.201.0/24) carrying the tool's hardcoded, outdated Teams Electron client User-Agent. UNK_CondorFiltration used this pattern to validate ~5,714 accounts across 28 tenants via the Teams API at roughly 300 accounts/sec without triggering lockouts, then sprayed passwords against the validated set.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1589, T1087.004, T1526, T1110.003, T1036
  • Data sources: azure_ad_signin_logs, o365_unified_audit_log
  • Severity: high
  • Confidence: high

Splunk SPL

index=azure_ad sourcetype="azure:aad:signin"
| eval ua=coalesce(UserAgent, user_agent), src_ip=coalesce(IPAddress, src_ip)
| where match(ua, "Teams/1\.3\.00\.30866.*Electron/8\.5\.1") OR cidrmatch("3.101.0.0/16", src_ip) OR cidrmatch("18.144.76.0/24", src_ip) OR cidrmatch("13.52.201.0/24", src_ip)
| bin _time span=10m
| stats dc(user) as unique_accounts_targeted, dc(src_ip) as unique_source_ips, count as auth_attempts by _time, tenant_id
| where unique_accounts_targeted > 50 AND unique_source_ips > 20
| sort - _time

Microsoft KQL

SigninLogs
| where TimeGenerated > ago(24h)
| where UserAgent has "Teams/1.3.00.30866" and UserAgent has "Electron/8.5.1"
| extend SrcIP = tostring(IPAddress)
| where ipv4_is_in_range(SrcIP, "3.101.0.0/16") or ipv4_is_in_range(SrcIP, "18.144.76.0/24") or ipv4_is_in_range(SrcIP, "13.52.201.0/24")
| summarize AuthAttempts=count(), DistinctAccounts=dcount(UserPrincipalName), DistinctIPs=dcount(SrcIP) by bin(TimeGenerated, 10m), AppDisplayName
| where DistinctAccounts > 50 and DistinctIPs > 20
| project TimeGenerated, AppDisplayName, AuthAttempts, DistinctAccounts, DistinctIPs

Sigma

title: TeamFiltration Enumeration/Spray Burst from AWS EC2 Ranges
id: a1e4f3c2-8b6d-4a2f-9e15-2c7d8b6a1f01
status: experimental
description: Detects a burst of sign-in events across many distinct M365 accounts from AWS EC2 ranges used by UNK_CondorFiltration's TeamFiltration-based enumeration and password-spray campaign.
references:
  - https://www.proofpoint.com/us/blog/threat-insight/Spraying-in-the-Andes-TeamFiltration-Returns
  - https://github.com/Flangvik/TeamFiltration/wiki/Enumeration
author: Threadlinqs Team
date: 2026-09-22
tags:
  - attack.reconnaissance
  - attack.t1589
  - attack.discovery
  - attack.t1087.004
  - attack.t1526
  - attack.credential_access
  - attack.t1110.003
  - attack.stealth
  - attack.t1036
  - attack.tool.teamfiltration
logsource:
  product: azure
  service: signinlogs
detection:
  selection_ua:
    UserAgent|contains:
      - 'Teams/1.3.00.30866'
      - 'Electron/8.5.1'
  selection_net:
    IPAddress|cidr:
      - '3.101.0.0/16'
      - '18.144.76.0/24'
      - '13.52.201.0/24'
  condition: selection_ua or selection_net | count(UserPrincipalName) by IPAddress > 50
timeframe: 10m
falsepositives:
  - Legitimate bulk provisioning/sync jobs authenticating many accounts in a short window from a shared corporate egress IP that happens to fall in a monitored AWS-hosted VDI range
  - Outdated but legitimate Teams Electron clients still running on unpatched AWS-hosted VDI/jump-box infrastructure
level: high

Known false positives:

  • Legitimate bulk onboarding/sync jobs (e.g. HR provisioning scripts) authenticating many accounts in a short window from a shared corporate egress IP that happens to fall in a monitored AWS-hosted VDI range
  • Outdated but legitimate Teams Electron clients still in use on unpatched AWS-hosted VDI/jump-box infrastructure

Tuning notes: Baseline the normal daily authentication volume and distinct-account count per tenant before setting the unique_accounts_targeted/unique_source_ips thresholds; the campaign's own waves ranged 100-1,560 accounts/day so a 50-account/10-minute window is a conservative starting point. Cross-reference src_ip against a maintained AWS EC2 CIDR feed rather than hardcoding only the three observed ranges, since FireProx-style rotation will pivot to fresh ranges over time.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Failed-Auth Fan-Out (Password Spray) from AWS EC2 Ranges · unlock with TL Creds
  • AWS-to-Azure-Portal Identity Pivot Within 90 Seconds (Post-Compromise) · unlock with TL Creds
  • Bulk Outlook REST API Email Collection Following Compromise (Mass MailItemsAccessed) · unlock with TL Creds
  • TeamFiltration Hardcoded Teams Electron User-Agent Fingerprint · unlock with TL Creds
  • MFA Security-Info Registration from AWS EC2 Range · unlock with TL Creds
  • Blocked Corporate VPN Portal Probe Following Conditional-Access Denial on Compromised Account · unlock with TL Creds
  • Dormant/Unmanaged Service Account First-Ever Sign-In from AWS EC2 Range · unlock with TL Creds
  • C2 Infrastructure Switch to [indicator]-Hosted German VPN Node Post-AWS Compromise · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 13 indicators of compromise for TL-2026-2616.

Sample indicators (1 of 13)

  • IP address: 149.88.104[.]19

Defanged, TLP:CLEAR. Full set of 13 indicators: unlock with TL Creds.

13 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

Between July 21 and August 16, 2026, Proofpoint tracked a three-wave password-spraying campaign against 28 Microsoft 365 tenants concentrated in Chile, attributing the activity to a cluster it designates UNK_CondorFiltration. The campaign generated 32,825 authentication events against 5,714 unique accounts from 1,487 unique source IPs, all resolving to Amazon Web Services (AWS) EC2 ranges (3.101.0.0/16, 18.144.76.0/24, 13.52.201.0/24). Proofpoint assesses the actor rotated across AWS regions via the FireProx IP-rotation technique to evade IP-based blocking during both the enumeration and spray phases.

The activity is consistent with TeamFiltration, a cross-platform (.NET) offensive framework for enumerating, spraying, exfiltrating from, and backdooring Microsoft 365 / Entra ID (formerly Azure AD) accounts. TeamFiltration was built internally at TrustedSec by Joakim Kandefelt (@Flangvik) starting in January 2021 and publicly released at DEF CON 30. Its enumeration module validates account existence via the Microsoft Teams API at roughly 300 accounts/second without triggering lockouts; its spray module tests passwords against the resulting validated-account list; its exfiltration module pulls Graph API user/group data, the last ~2,000 Outlook emails via the Outlook REST API, and Teams/OneDrive/SharePoint files and chats; and an interactive backdoor module can grant persistent OneDrive access. All observed requests carried a single hardcoded, outdated Microsoft Teams Electron client User-Agent string (Teams/1.3.00.30866, Chrome/80.0.3987.165, Electron/8.5.1) — the campaign's most reliable detection fingerprint.

Campaign activity ran in three distinct waves: July 21-24 (roughly 100-120 accounts/day against Chilean banks), July 26-28 (peaking at ~1,520 accounts on July 27 against a financial institution), and August 13-16 (peaking at ~1,560 accounts on August 15 against a major, unnamed Chilean retailer that alone accounted for 53.2% of all targeted accounts and 78.3% of all authentication events in the campaign). Every one of the 7 confirmed compromises traced to the same root cause: a default, unrotated password on a dormant or unmanaged service/functional account with no MFA enforcement and no prior sign-in history. Proofpoint observed the actor pivot from AWS-sourced initial access to the Azure Portal (triggering MFA enrollment prompts) within approximately 90 seconds, switch to a German VPN egress node (149.88.104.19, hosted via cdn77.com) for follow-on activity, conduct SharePoint Online reconnaissance, request Microsoft Graph API tokens, and attempt (unsuccessfully) to probe corporate VPN portals — those attempts were blocked by MFA and Conditional Access policies that were not applied to the compromised service accounts themselves. Applications accessed included Microsoft Teams (client ID 1fec8e78-bce4-4aaf-ab1b-5451cc387264), Office/Outlook (d3590ed6-52b3-4102-aeff-aad2292ab01c), OneDrive (ab9b8c07-8f02-4f72-87fa-80105867a763), Azure Portal (c44b4083-3bb0-49c1-b47d-974e53cbdf3c), and SharePoint (00000003-0000-0ff1-ce00-000000000000).

TeamFiltration abuse is not new: Proofpoint separately tracked a distinct, related activity set, UNK_SneakyStrike, that used the same tool to target over 80,000 Entra ID accounts across roughly 100 cloud tenants beginning in December 2024 (peaking January 8, 2025 at 16,500 accounts in a single day), sourced primarily from US/Ireland/UK AWS regions, exploiting Microsoft OAuth 'family refresh token' abuse for broader account access and exhibiting the same distinctive outdated Teams user-agent. UNK_CondorFiltration's AWS-EC2/FireProx tradecraft and identical tool fingerprint are consistent with that lineage, though Proofpoint tracks it as a separate cluster given the differing infrastructure, targeting geography (Latin America vs. global), and campaign timing. The recurring structural gap across both clusters is the same: forgotten, unmanaged, non-interactive service accounts are provisioned without MFA and go unmonitored, making them the most exploitable identity in an otherwise hardened M365 tenant.

MITRE ATT&CK techniques by tactic:

Stealth

T1036 Masquerading

Initial Access

T1078.004 Cloud Accounts; T1133 External Remote Services

Persistence

T1078.004 Cloud Accounts

Discovery

T1087.004 Cloud Account; T1526 Cloud Service Discovery; T1538 Cloud Service Dashboard

Command and Control

T1090.002 External Proxy

Credential Access

T1110.003 Password Spraying; T1528 Steal Application Access Token

Collection

T1114.002 Remote Email Collection; T1119 Automated Collection; T1213 Data from Information Repositories; T1213.002 Data from Information Repositories; T1530 Data from Cloud Storage

Exfiltration

T1567 Exfiltration Over Web Service

Resource Development

T1583.006 Web Services

Reconnaissance

T1589 Gather Victim Identity Information; T1589.002 Gather Victim Identity Information

Remediation

Immediate actions

  • Enforce MFA and Conditional Access on all Microsoft 365 / Entra ID accounts, including dormant and unmanaged service/functional accounts
  • Audit all service accounts tenant-wide for default or unrotated passwords and rotate/disable any with no recent legitimate sign-in history
  • Alert on and block authentication attempts to service accounts originating from AWS EC2 IP ranges (3.101.0.0/16, 18.144.76.0/24, 13.52.201.0/24) or other unexpected cloud-hosting ASNs

Workarounds

  • Hunt Entra ID / M365 unified audit sign-in logs for the hardcoded TeamFiltration Teams client User-Agent (Teams/1.3.00.30866 Chrome/80.0.3987.165 Electron/8.5.1)
  • Flag sign-ins to Teams, Office, OneDrive, Azure Portal, or SharePoint (application IDs 1fec8e78-bce4-4aaf-ab1b-5451cc387264, d3590ed6-52b3-4102-aeff-aad2292ab01c, ab9b8c07-8f02-4f72-87fa-80105867a763, c44b4083-3bb0-49c1-b47d-974e53cbdf3c, 00000003-0000-0ff1-ce00-000000000000) from devices/user-agents inconsistent with the signing-in account's normal client
  • Correlate concentrated, wave-shaped bursts of failed authentication from sequential/rotating source IPs against many distinct accounts as a password-spray indicator

Longer-term hardening

  • Establish and monitor sign-in baselines per service account (expected source ASN/geo, time window, application) and alert on deviation
  • Inventory and lifecycle-manage all non-interactive/service accounts across every M365 tenant, including deprovisioning genuinely unused accounts
  • Require Conditional Access policies (compliant device, MFA, trusted location) apply uniformly to service accounts, not just interactive user accounts

Affected and fixed versions

  • Microsoft — Microsoft 365 / Entra ID
    Vulnerable versions: Tenants with dormant or unmanaged service/functional accounts lacking MFA and Conditional Access enforcement
    Fixed in: Tenants enforcing MFA and Conditional Access uniformly across all accounts, including service accounts

Timeline

Last updated · revalidated 1× · latest source

  • TeamFiltration framework (Flangvik / TrustedSec) enters internal use in January 2021, per Proofpoint.
  • TeamFiltration is publicly released at DEF CON 30 (August 2022).
  • Wave 1 begins: UNK_CondorFiltration credential-sprays Chilean banks at roughly 100-120 accounts/day from AWS EC2-sourced infrastructure using TeamFiltration-consistent tooling.
  • Wave 1 of the campaign concludes.
  • Wave 2 begins, shifting focus to a Chilean financial institution.
  • Wave 2 peaks at approximately 1,520 accounts targeted in a single day.
  • Wave 2 of the campaign concludes.
  • Wave 3 begins, targeting a major, unnamed Chilean retailer that ultimately accounts for 53.2% of all targeted accounts and 78.3% of all authentication events in the campaign.
  • Seven unmanaged functional/service accounts are compromised by password spray on Aug 14-15. In the case-study account, the spray succeeds at 18:41:41 UTC. A VPN SAML probe from German IP locked-ioc-3 follows, then Azure Portal access (MFA enrollment prompt), SharePoint Online access and a Graph token request. Proofpoint reports no attacker persistence.
  • Wave 3 peaks at approximately 1,560 accounts targeted in a single day.
  • Campaign activity window closes. Final totals: 5,714 unique accounts targeted across 28 M365 tenants, 32,825 authentication events from 1,487 unique AWS EC2 source IPs, and 7 confirmed compromises of dormant/unmanaged service accounts. Post-compromise activity on the confirmed accounts included an AWS-to-Azure-Portal pivot within roughly 90 seconds of initial access, a switch to a German VPN egress node (locked-ioc-3 via cdn77.com), SharePoint Online reconnaissance, Microsoft Graph API token requests, and blocked attempts to probe corporate VPN portals (stopped by MFA/Conditional Access).
  • Proofpoint Threat Insight publishes 'Spraying in the Andes: TeamFiltration Returns to Exploit Forgotten Service Accounts,' publicly disclosing the UNK_CondorFiltration campaign and attributing it to the TeamFiltration framework.

Update history

Sources cited

Previous and next in cloud

Drafted by the Threadlinqs research pipeline from 9 sources; published ; last updated .

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats