Hackers Broke Into Microsoft 365 Through Forgotten Accounts Nobody Was Watching
Proofpoint tracks UNK_CondorFiltration password-spraying campaign compromising seven unmonitored Microsoft 365 service accounts at Chilean organizations via TeamFiltration.
Proofpoint identified a campaign dubbed UNK_CondorFiltration that abused the TeamFiltration framework to spray likely default passwords across 5,714 accounts in 28 Microsoft 365 tenants, mainly targeting Chilean organizations including a large retailer and financial institutions. Seven confirmed compromises all involved functional or service accounts without MFA, clear ownership, or prior legitimate sign-in activity; six were breached within seven minutes. Following successful logins from AWS EC2 infrastructure, attackers accessed Office, OneDrive, Teams, and SharePoint, with one intrusion pivoting through a German VPN node. The August 13-16 wave peaked at about 1,560 targeted accounts on August 15.
- 5,714 accounts across 28 Microsoft 365 tenants targeted; seven service-account compromises confirmed
- Compromised accounts lacked MFA and ownership; six breached within seven minutes via password spraying
- TeamFiltration run from AWS infrastructure accessed OneDrive, SharePoint, and Teams data
- Primary victims were Chilean retail and financial organizations during August 13-16
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | cdn77.com | tructure, not a malicious domain by itself. Provider domain cdn77.com Provider attribution associated with the post-access IP, no |
| domain | datacamp.co.uk | ccess IP, not a malicious domain by itself. Provider domain datacamp.co.uk Additional provider attribution for the post-access IP, not |
| ipv4 | 149.88.104.19 | crosoft Teams compromise in the documented case. IP address 149.88.104.19 German VPN node used for subsequent VPN probing and cloud a |
| ipv4 | 3.101.157.240 | nfrastructure associated with password spraying. IP address 3.101.157.240 Source of the initial Microsoft Teams compromise in the doc |
Full article1,021 words · extracted from cybersecuritynews.com · click to collapse
Hackers have breached Microsoft 365 environments by targeting accounts that were still active but unmonitored. An old password and missing sign-in protections gave intruders a route into email, files, and cloud applications.
The campaign focused heavily on organisations in Chile, including a large retailer and financial institutions.
Rather than repeatedly guessing passwords for one person, the operator tested likely default passwords across many accounts, a technique seen in similar password spraying attacks, then used successful logins to explore cloud services.
Proofpoint analysts identified the activity as UNK_CondorFiltration, a campaign abusing TeamFiltration, a testing framework rather than a new malware strain.
Proofpoint said in a report shared with Cyber Security News (CSN) as source material that the operation hit 5,714 accounts across 28 Microsoft 365 tenants and produced seven confirmed compromises.
The numbers underline a narrow but serious weakness. None of the confirmed breaches involved personal employee accounts.
Every affected identity was a functional or service account, the kind created to process payments, run ticketing, support point-of-sale systems, or perform other routine tasks without a person regularly logging in.
Hackers Broke Into Microsoft 365 Through Forgotten Accounts
Researchers found that the seven compromised accounts had no earlier legitimate sign-in activity in the available records. Six were breached within seven minutes, a pattern that points to shared or unchanged default passwords rather than individually stolen credentials.
The accounts remained enabled, lacked clear ownership, and apparently had no multi-factor authentication, or MFA, to stop a valid password from being enough.
One retailer accounted for 25,715 of the campaign’s 32,825 authentication events, or 78.3 percent. The August 13 to 16 wave peaked at about 1,560 targeted accounts on August 15, and all seven confirmed compromises occurred at the retailer on August 14 and 15.
The pattern resembles a earlier TeamFiltration takeover campaign using the same framework against cloud identities. TeamFiltration can check whether accounts exist through the Teams API, test passwords at scale, and use cloud infrastructure to vary its source locations.
Following a successful sign-in, it can collect email, Teams messages, and OneDrive or SharePoint data. That makes an overlooked operational account particularly useful.
The findings point to practical safeguards. Organisations should inventory service accounts, assign an accountable owner, remove accounts that no longer serve a purpose, rotate any inherited credentials, and require MFA or a safer workload identity where possible.
Teams should also review conditional-access rules and sign-in logs for broad failures across many accounts, as coverage of Microsoft 365 spraying attacks also explains.
From Valid Login to Cloud Reconnaissance
The activity did not always end with a password check. For most affected accounts, researchers observed access to Microsoft Office, OneDrive, and Teams from the same cloud-hosted infrastructure.
That behavior is consistent with TeamFiltration’s automatic collection mode, though sign-in logs alone cannot prove that files or messages were removed.
In one case, the attacker changed to a German VPN node within 90 seconds of the initial compromise. The operator unsuccessfully probed the corporate VPN, then opened Azure Portal, OfficeHome, and SharePoint Online.
An MFA enrolment prompt during the Azure Portal visit indicated that the compromised account had not been configured for MFA.
The SharePoint access could have supported document discovery, data theft, or an attempt to place a harmful file where a trusted user might later open it.
A request for an access token through the SharePoint Online Web Client Extensibility application also suggested an effort to interact with Microsoft Graph or external application interfaces.
Similar post-login abuse has appeared in reports on hidden cloud mailbox rules, which can help intruders quietly retain visibility into business email.
Defenders should treat inactive accounts as an identity risk, not administrative clutter. Alerting on the distinctive user agent, password attempts from distributed cloud hosts, first-time sign-ins, and sudden access to sensitive apps can expose this type of intrusion early.
Blocking legacy or unnecessary sign-in paths and testing MFA coverage on non-human accounts can close the gap that this campaign exploited.
Indicators of compromise (IoCs):-
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC
Tushar is a senior cybersecurity and breach reporter. He specializes in covering cybersecurity news, trends, and emerging threats, data breaches, and malware attacks. With years of experience, he brings clarity and depth to complex security topics.