[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$feVLgsclQ9Cqsjfe0WI_hkItGpZupEkox_rvtdMYZ4vM":3},{"article":4,"iocs":54,"watch_terms":57,"solutions":58,"lesson":155},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"7f55c809-6ba4-4238-91ec-877f6cdcb7dc","TeamFiltration Campaign Compromises Seven Microsoft 365 Accounts Using Default Passwords","teamfiltration-campaign-compromises-seven-microsoft-365-accounts-using-default-p-b54ca6","Cybersecurity researchers have disclosed details of an active TeamFiltration campaign codenamed UNK_CondorFiltration that has targeted over 5,700 accounts across 28 Microsoft 365 tenants. According to Proofpoint, the activity has primarily focused on Chilean retail and financial institutions. It originated from 1,487 unique AWS EC2 source IP addresses. \"The campaign compromised 7 accounts –","A TeamFiltration campaign, codenamed UNK_CondorFiltration, has targeted over 5,700 Microsoft 365 accounts across 28 tenants, primarily focusing on Chilean financial and retail institutions. The campaign successfully compromised seven unmanaged service accounts by exploiting default or unrotated passwords, highlighting a significant exposure gap for non-human identities. The threat actor utilized the TeamFiltration framework to enumerate accounts, test credentials, and potentially exfiltrate data.","TeamFiltration campaign targets Microsoft 365 accounts using default passwords.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fteamfiltration-compromises-seven.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEgQgKN3zS7GtEpakDcL7zk0tL-zcz3GJMkVf9vMLCVXf33XZ1Yad77dg3Zen_EEB58BltCG_pj0c-yVDm6VbV9cw5Baxtf26vVtRwW4qwDDy1s8HYMFKfTyl382lwJIRfSWBSA-WK6RAZ8lmy9zf5IZb_Ilqol0AcVdEaMp599tZ4NxqUc-KY4-fyFNYYFg\u002Fs1600\u002Fms-365.jpg","2026-09-24T06:32:03+00:00","2026-09-24T10:00:28.136933+00:00",8,[17,20,23,25,28],{"name":18,"type":19},"TeamFiltration","threat_actor",{"name":21,"type":22},"Microsoft 365","product",{"name":24,"type":22},"AWS EC2",{"name":26,"type":27},"Entra ID","technology",{"name":29,"type":30},"Proofpoint","vendor","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":31,"icon":33,"name":34,"slug":35},null,"Threat Intelligence","threat-intelligence",[37,42,47,52],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":48},{"id":49,"icon":33,"name":50,"slug":51},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":53},{"id":31,"icon":33,"name":34,"slug":35},[55],{"type":46,"value":18,"context":56},"Offensive framework used in the campaign",[29,21,24],{"controls":59,"vendors":143},[60,89,117],{"slug":61,"name":62,"problem":63,"products":64},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[65,73,81],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"slug":90,"name":91,"problem":92,"products":93},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[94,102,109],{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":90,"product_name":106,"url":107,"description":108},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"slug":118,"name":119,"problem":120,"products":121},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[122,127,135],{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":123,"product_name":124,"url":125,"description":126},"identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",[144,150],{"slug":145,"name":146,"logo_path":147,"roles":148},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[149],"affected",{"slug":151,"name":29,"logo_path":152,"roles":153},"proofpoint","\u002Fvendor-logos\u002Fproofpoint.png",[154],"reported_by",{"slug":156,"title":157,"body":158,"framework_refs":159,"framework_notes":172},"default-passwords-on-service-accounts-fuel-microsoft-365-compromise","Default Passwords on Service Accounts Fuel Microsoft 365 Compromise","Seven Microsoft 365 service accounts were compromised because they retained default or never-rotated passwords, giving attackers an easy foothold through the TeamFiltration credential-testing framework. Non-human identities (service accounts, shared mailboxes, automation accounts) are frequently overlooked in password hygiene programs, creating a silent exposure gap. The campaign affected over 5,700 accounts across 28 tenants, demonstrating how a single misconfiguration can cascade into broad organizational risk. This matters because unmanaged service accounts often hold elevated privileges and are rarely monitored for anomalous sign-in activity.",[160,161,162,163,164,165,166,167,168,169,170,171],"CIS Control 5 – Account Management","CIS Control 6 – Access Control Management","CIS Control 12 – Network Infrastructure Management","NIST SP 800-53 AC-2 (Account Management)","NIST SP 800-53 IA-5 (Authenticator Management)","NIST SP 800-53 AU-2 (Event Logging)","NIST SP 800-63B – Digital Identity Guidelines (Password Requirements)","MITRE ATT&CK T1110.001 – Brute Force: Password Guessing","MITRE ATT&CK T1078.004 – Valid Accounts: Cloud Accounts","GDPR Article 32 – Security of Processing (appropriate technical measures)","ISO\u002FIEC 27001:2022 A.5.16 – Identity Management","ISO\u002FIEC 27001:2022 A.8.5 – Secure Authentication",{}]