# TeamFiltration Returns: UNK_CondorFiltration Credential-Spraying Campaign Targets Dormant M365 Service Accounts in Latin America

> Proofpoint identified a renewed campaign, tracked as UNK_CondorFiltration, using the open-source TeamFiltration offensive framework to credential-spray 28 Microsoft 365 tenants across Latin America, concentrated on Chilean retail and financial-sector organizations. Over 5,714 accounts were targeted across three waves between July 21 and August 16, 2026, resulting in 7 confirmed compromises of dormant, unmanaged service accounts lacking MFA, followed by post-compromise reconnaissance and attempted exfiltration of email, Teams chats, and OneDrive/SharePoint data.

- **Published:** 2026-09-22T00:00:00Z
- **Last reviewed:** 2026-09-22T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2616
- **ID:** TL-2026-2616
- **Severity:** HIGH
- **Category:** CLOUD
- **Status:** ACTIVE
- **Actor:** UNK_CondorFiltration
- **Detections:** 9 · **IOCs:** 7 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Between July 21 and August 16, 2026, Proofpoint tracked a three-wave password-spraying campaign against 28 Microsoft 365 tenants concentrated in Chile, attributing the activity to a cluster it designates UNK_CondorFiltration. The campaign generated 32,825 authentication events against 5,714 unique accounts from 1,487 unique source IPs, all resolving to Amazon Web Services (AWS) EC2 ranges (3.101.0.0/16, 18.144.76.0/24, 13.52.201.0/24). Proofpoint assesses the actor rotated across AWS regions via the FireProx IP-rotation technique to evade IP-based blocking during both the enumeration and spray phases.

The activity is consistent with TeamFiltration, a cross-platform (.NET) offensive framework for enumerating, spraying, exfiltrating from, and backdooring Microsoft 365 / Entra ID (formerly Azure AD) accounts. TeamFiltration was built internally at TrustedSec by Joakim Kandefelt (@Flangvik) starting in January 2021 and publicly released at DEF CON 30. Its enumeration module validates account existence via the Microsoft Teams API at roughly 300 accounts/second without triggering lockouts; its spray module tests passwords against the resulting validated-account list; its exfiltration module pulls Graph API user/group data, the last ~2,000 Outlook emails via the Outlook REST API, and Teams/OneDrive/SharePoint files and chats; and an interactive backdoor module can grant persistent OneDrive access. All observed requests carried a single hardcoded, outdated Microsoft Teams Electron client User-Agent string (Teams/1.3.00.30866, Chrome/80.0.3987.165, Electron/8.5.1) — the campaign's most reliable detection fingerprint.

Campaign activity ran in three distinct waves: July 21-24 (roughly 100-120 accounts/day against Chilean banks), July 26-28 (peaking at ~1,520 accounts on July 27 against a financial institution), and August 13-16 (peaking at ~1,560 accounts on August 15 against a major, unnamed Chilean retailer that alone accounted for 53.2% of all targeted accounts and 78.3% of all authentication events in the campaign). Every one of the 7 confirmed compromises traced to the same root cause: a default, unrotated password on a dormant or unmanaged service/functional account with no MFA enforcement and no prior sign-in history. Proofpoint observed the actor pivot from AWS-sourced initial access to the Azure Portal (triggering MFA enrollment prompts) within approximately 90 seconds, switch to a German VPN egress node (149.88.104.19, hosted via cdn77.com) for follow-on activity, conduct SharePoint Online reconnaissance, request Microsoft Graph API tokens, and attempt (unsuccessfully) to probe corporate VPN portals — those attempts were blocked by MFA and Conditional Access policies that were not applied to the compromised service accounts themselves. Applications accessed included Microsoft Teams (client ID 1fec8e78-bce4-4aaf-ab1b-5451cc387264), Office/Outlook (d3590ed6-52b3-4102-aeff-aad2292ab01c), OneDrive (ab9b8c07-8f02-4f72-87fa-80105867a763), Azure Portal (c44b4083-3bb0-49c1-b47d-974e53cbdf3c), and SharePoint (00000003-0000-0ff1-ce00-000000000000).

TeamFiltration abuse is not new: Proofpoint separately tracked a distinct, related activity set, UNK_SneakyStrike, that used the same tool to target over 80,000 Entra ID accounts across roughly 100 cloud tenants beginning in December 2024 (peaking January 8, 2025 at 16,500 accounts in a single day), sourced primarily from US/Ireland/UK AWS regions, exploiting Microsoft OAuth 'family refresh token' abuse for broader account access and exhibiting the same distinctive outdated Teams user-agent. UNK_CondorFiltration's AWS-EC2/FireProx tradecraft and identical tool fingerprint are consistent with that lineage, though Proofpoint tracks it as a separate cluster given the differing infrastructure, targeting geography (Latin America vs. global), and campaign timing. The recurring structural gap across both clusters is the same: forgotten, unmanaged, non-interactive service accounts are provisioned without MFA and go unmonitored, making them the most exploitable identity in an otherwise hardened M365 tenant.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1583.006 Web Services
- T1078.004 Cloud Accounts
- T1078.004 Cloud Accounts
- T1110.003 Password Spraying
- T1528 Steal Application Access Token
- T1087.004 Cloud Account
- T1526 Cloud Service Discovery
- T1036 Masquerading
- T1090.002 External Proxy
- T1114.002 Remote Email Collection
- T1213 Data from Information Repositories
- T1119 Automated Collection
- T1567 Exfiltration Over Web Service

## Sources

- [Spraying in the Andes: TeamFiltration Returns to Exploit Forgotten Service Accounts](https://www.proofpoint.com/us/blog/threat-insight/Spraying-in-the-Andes-TeamFiltration-Returns)
- [Attackers Unleash TeamFiltration: Account Takeover Campaign (UNK_SneakyStrike) Leverages Popular Pentesting Tool](https://www.proofpoint.com/us/blog/threat-insight/attackers-unleash-teamfiltration-account-takeover-campaign)
- [GitHub - Flangvik/TeamFiltration: cross-platform framework for enumerating, spraying, exfiltrating, and backdooring O365 AAD accounts](https://github.com/Flangvik/TeamFiltration)
- [Enumeration · Flangvik/TeamFiltration Wiki](https://github.com/Flangvik/TeamFiltration/wiki/Enumeration)
- [Spraying · Flangvik/TeamFiltration Wiki](https://github.com/Flangvik/TeamFiltration/wiki/Spraying)
- [Exfiltration · Flangvik/TeamFiltration Wiki](https://github.com/Flangvik/TeamFiltration/wiki/Exfiltration)
- [Over 80,000 Microsoft Entra ID Accounts Targeted Using Open-Source TeamFiltration Tool](https://thehackernews.com/2025/06/over-80000-microsoft-entra-id-accounts.html)
- [New Campaign Targets Entra ID User Accounts Using Pentesting Tool for Account Takeover](https://gbhackers.com/new-campaign-targets-entra-id-user-accounts/)
- [TeamFiltration pentesting tool harnessed in global Microsoft Entra ID attack campaign](https://www.scworld.com/brief/teamfiltration-pentesting-tool-harnessed-in-global-microsoft-entra-id-attack-campaign)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2616