{"id":3119,"date":"2026-09-24T09:58:15","date_gmt":"2026-09-24T09:58:15","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3119"},"modified":"2026-09-24T09:58:15","modified_gmt":"2026-09-24T09:58:15","slug":"teamfiltration-campaign-compromises-seven-microsoft-365-accounts-using-default-passwords","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3119","title":{"rendered":"TeamFiltration Campaign Compromises Seven Microsoft 365 Accounts Using Default Passwords"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Sep 24, 2026<\/span><\/span>Cloud Security \/ Identity Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Cybersecurity researchers have disclosed details of an active TeamFiltration campaign codenamed UNK_CondorFiltration<\/a><\/strong> that has targeted over 5,700 accounts across 28 Microsoft 365 tenants.<\/p>\n

According to Proofpoint, the activity has primarily focused on Chilean retail and financial institutions. It originated from 1,487 unique AWS EC2 source IP addresses.<\/p>\n

\u00abThe campaign compromised 7 accounts \u2013 all of which were unmanaged functional or service accounts rather than individual employee accounts \u2013 highlighting a critical exposure gap around forgotten, non-human identities carrying default or unrotated passwords and no MFA [multi-factor authentication],\u00bb the enterprise security company said in a statement.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The Microsoft 365 brute-force campaign is said to have unfolded across three different waves from late July to August 2026, with an unnamed Chilean retailer facing the brunt of 78.3% of all observed authentication events –<\/p>\n