TeamFiltration Returns: UNK_CondorFiltration Credential-Spraying Campaign Targets Dormant M365 Service Accounts in Latin America
TeamFiltration Returns (TL-2026-2616), also tracked as Spraying in the Andes, is a high-severity cloud security threat, first published 2026-09-22. It is attributed to UNK_CondorFiltration with low confidence, affects Microsoft Microsoft 365 / Entra ID, maps to 13 MITRE ATT&CK techniques (T1036, T1078.004, T1087.004), and is covered by 9 detection rules and 7 indicators of compromise.
Key facts for TL-2026-2616
- Threat ID
- TL-2026-2616
- Also known as
- Spraying in the Andes
- Severity
- HIGH
- Status
- ACTIVE
- Category
- CLOUD
- First published
- 2026-09-22
- Last reviewed
- 2026-09-22
- Attribution
- UNK_CondorFiltration
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- retail, finance
- Target regions
- Latin America, chile
- Detection rules
- 9
- Indicators of compromise
- 7
Malware and tooling in TeamFiltration Returns
Malware and tooling: FireProx, TeamFiltration
Proofpoint identified a renewed campaign, tracked as UNK_CondorFiltration, using the open-source TeamFiltration offensive framework to credential-spray 28 Microsoft 365 tenants across Latin America, concentrated on Chilean retail and financial-sector organizations. Over 5,714 accounts were targeted across three waves between July 21 and August 16, 2026, resulting in 7 confirmed compromises of dormant, unmanaged service accounts lacking MFA, followed by post-compromise reconnaissance and attempted exfiltration of email, Teams chats, and OneDrive/SharePoint data.
How TeamFiltration Returns works
Between July 21 and August 16, 2026, Proofpoint tracked a three-wave password-spraying campaign against 28 Microsoft 365 tenants concentrated in Chile, attributing the activity to a cluster it designates UNK_CondorFiltration. The campaign generated 32,825 authentication events against 5,714 unique accounts from 1,487 unique source IPs, all resolving to Amazon Web Services (AWS) EC2 ranges (3.101.0.0/16, 18.144.76.0/24, 13.52.201.0/24). Proofpoint assesses the actor rotated across AWS regions via the FireProx IP-rotation technique to evade IP-based blocking during both the enumeration and spray phases.
The activity is consistent with TeamFiltration, a cross-platform (.NET) offensive framework for enumerating, spraying, exfiltrating from, and backdooring Microsoft 365 / Entra ID (formerly Azure AD) accounts. TeamFiltration was built internally at TrustedSec by Joakim Kandefelt (@Flangvik) starting in January 2021 and publicly released at DEF CON 30. Its enumeration module validates account existence via the Microsoft Teams API at roughly 300 accounts/second without triggering lockouts; its spray module tests passwords against the resulting validated-account list; its exfiltration module pulls Graph API user/group data, the last ~2,000 Outlook emails via the Outlook REST API, and Teams/OneDrive/SharePoint files and chats; and an interactive backdoor module can grant persistent OneDrive access. All observed requests carried a single hardcoded, outdated Microsoft Teams Electron client User-Agent string (Teams/1.3.00.30866, Chrome/80.0.3987.165, Electron/8.5.1) — the campaign's most reliable detection fingerprint.
Campaign activity ran in three distinct waves: July 21-24 (roughly 100-120 accounts/day against Chilean banks), July 26-28 (peaking at ~1,520 accounts on July 27 against a financial institution), and August 13-16 (peaking at ~1,560 accounts on August 15 against a major, unnamed Chilean retailer that alone accounted for 53.2% of all targeted accounts and 78.3% of all authentication events in the campaign). Every one of the 7 confirmed compromises traced to the same root cause: a default, unrotated password on a dormant or unmanaged service/functional account with no MFA enforcement and no prior sign-in history. Proofpoint observed the actor pivot from AWS-sourced initial access to the Azure Portal (triggering MFA enrollment prompts) within approximately 90 seconds, switch to a German VPN egress node (149.88.104.19, hosted via cdn77.com) for follow-on activity, conduct SharePoint Online reconnaissance, request Microsoft Graph API tokens, and attempt (unsuccessfully) to probe corporate VPN portals — those attempts were blocked by MFA and Conditional Access policies that were not applied to the compromised service accounts themselves. Applications accessed included Microsoft Teams (client ID 1fec8e78-bce4-4aaf-ab1b-5451cc387264), Office/Outlook (d3590ed6-52b3-4102-aeff-aad2292ab01c), OneDrive (ab9b8c07-8f02-4f72-87fa-80105867a763), Azure Portal (c44b4083-3bb0-49c1-b47d-974e53cbdf3c), and SharePoint (00000003-0000-0ff1-ce00-000000000000).
TeamFiltration abuse is not new: Proofpoint separately tracked a distinct, related activity set, UNK_SneakyStrike, that used the same tool to target over 80,000 Entra ID accounts across roughly 100 cloud tenants beginning in December 2024 (peaking January 8, 2025 at 16,500 accounts in a single day), sourced primarily from US/Ireland/UK AWS regions, exploiting Microsoft OAuth 'family refresh token' abuse for broader account access and exhibiting the same distinctive outdated Teams user-agent. UNK_CondorFiltration's AWS-EC2/FireProx tradecraft and identical tool fingerprint are consistent with that lineage, though Proofpoint tracks it as a separate cluster given the differing infrastructure, targeting geography (Latin America vs. global), and campaign timing. The recurring structural gap across both clusters is the same: forgotten, unmanaged, non-interactive service accounts are provisioned without MFA and go unmonitored, making them the most exploitable identity in an otherwise hardened M365 tenant.
MITRE ATT&CK techniques used in TL-2026-2616
Stealth
Initial Access
Persistence
Discovery
T1087.004 Cloud Account; T1526 Cloud Service Discovery
Command and Control
Credential Access
T1110.003 Password Spraying; T1528 Steal Application Access Token
Collection
T1114.002 Remote Email Collection; T1119 Automated Collection; T1213 Data from Information Repositories
Exfiltration
T1567 Exfiltration Over Web Service
Resource Development
Reconnaissance
Affected products and versions in TeamFiltration Returns
- Microsoft — Microsoft 365 / Entra ID
Vulnerable versions: Tenants with dormant or unmanaged service/functional accounts lacking MFA and Conditional Access enforcement
Fixed in: Tenants enforcing MFA and Conditional Access uniformly across all accounts, including service accounts
Remediation for TeamFiltration Returns
Immediate actions
- Enforce MFA and Conditional Access on all Microsoft 365 / Entra ID accounts, including dormant and unmanaged service/functional accounts
- Audit all service accounts tenant-wide for default or unrotated passwords and rotate/disable any with no recent legitimate sign-in history
- Alert on and block authentication attempts to service accounts originating from AWS EC2 IP ranges (3.101.0.0/16, 18.144.76.0/24, 13.52.201.0/24) or other unexpected cloud-hosting ASNs
Workarounds
- Hunt Entra ID / M365 unified audit sign-in logs for the hardcoded TeamFiltration Teams client User-Agent (Teams/1.3.00.30866 Chrome/80.0.3987.165 Electron/8.5.1)
- Flag sign-ins to Teams, Office, OneDrive, Azure Portal, or SharePoint (application IDs 1fec8e78-bce4-4aaf-ab1b-5451cc387264, d3590ed6-52b3-4102-aeff-aad2292ab01c, ab9b8c07-8f02-4f72-87fa-80105867a763, c44b4083-3bb0-49c1-b47d-974e53cbdf3c, 00000003-0000-0ff1-ce00-000000000000) from devices/user-agents inconsistent with the signing-in account's normal client
- Correlate concentrated, wave-shaped bursts of failed authentication from sequential/rotating source IPs against many distinct accounts as a password-spray indicator
Longer-term hardening
- Establish and monitor sign-in baselines per service account (expected source ASN/geo, time window, application) and alert on deviation
- Inventory and lifecycle-manage all non-interactive/service accounts across every M365 tenant, including deprovisioning genuinely unused accounts
- Require Conditional Access policies (compliant device, MFA, trusted location) apply uniformly to service accounts, not just interactive user accounts
Timeline of TeamFiltration Returns
- Wave 1 begins: UNK_CondorFiltration credential-sprays Chilean banks at roughly 100-120 accounts/day from AWS EC2-sourced infrastructure using TeamFiltration-consistent tooling.
- Wave 1 of the campaign concludes.
- Wave 2 begins, shifting focus to a Chilean financial institution.
- Wave 2 peaks at approximately 1,520 accounts targeted in a single day.
- Wave 2 of the campaign concludes.
- Wave 3 begins, targeting a major, unnamed Chilean retailer that ultimately accounts for 53.2% of all targeted accounts and 78.3% of all authentication events in the campaign.
- Wave 3 peaks at approximately 1,560 accounts targeted in a single day.
- Campaign activity window closes. Final totals: 5,714 unique accounts targeted across 28 M365 tenants, 32,825 authentication events from 1,487 unique AWS EC2 source IPs, and 7 confirmed compromises of dormant/unmanaged service accounts. Post-compromise activity on the confirmed accounts included an AWS-to-Azure-Portal pivot within roughly 90 seconds of initial access, a switch to a German VPN egress node (149.88.104.19 via cdn77.com), SharePoint Online reconnaissance, Microsoft Graph API token requests, and blocked attempts to probe corporate VPN portals (stopped by MFA/Conditional Access).
- Proofpoint Threat Insight publishes 'Spraying in the Andes: TeamFiltration Returns to Exploit Forgotten Service Accounts,' publicly disclosing the UNK_CondorFiltration campaign and attributing it to the TeamFiltration framework.
Sources cited for TeamFiltration Returns
- Spraying in the Andes: TeamFiltration Returns to Exploit Forgotten Service Accounts
- Attackers Unleash TeamFiltration: Account Takeover Campaign (UNK_SneakyStrike) Leverages Popular Pentesting Tool
- GitHub - Flangvik/TeamFiltration: cross-platform framework for enumerating, spraying, exfiltrating, and backdooring O365 AAD accounts
- Enumeration · Flangvik/TeamFiltration Wiki
- Spraying · Flangvik/TeamFiltration Wiki
- Exfiltration · Flangvik/TeamFiltration Wiki
- Over 80,000 Microsoft Entra ID Accounts Targeted Using Open-Source TeamFiltration Tool
- New Campaign Targets Entra ID User Accounts Using Pentesting Tool for Account Takeover
- TeamFiltration pentesting tool harnessed in global Microsoft Entra ID attack campaign
More in cloud
- Unauthenticated AWS API Gateway + Over-Permissioned Lambda: Credential Extraction Attack Chain
- OAuth Client ID Spoofing Enables Stealthy Enumeration of Microsoft Entra ID Accounts (UNK_pyreq2323 / UNK_OutFlareAZ)
- Frontier AI Agents Compress Full Enterprise Intrusion Chain into Under 10 Hours (Unit 42 Investigation)
- Password Spraying Campaign Targets AWS Root User Accounts Across 150+ Organizations
- AWS IAM Privilege Escalation Attack Path via iam:CreateAccessKey, iam:UpdateLoginProfile, and iam:UpdateAssumeRolePolicy (Horizon3.ai NodeZero Case Study)
Detection coverage for TL-2026-2616
As of 2026-09-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2616 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.