As reported by The Hacker News, Proofpoint has disclosed an active TeamFiltration campaign—codenamed UNK_CondorFiltration—that sprayed over 5,700 accounts across 28 Microsoft 365 tenants, successfully compromising seven. The targeting pattern is telling: every single compromised account was an unmanaged functional or service account carrying default or unrotated credentials with no MFA enforcement.
This campaign is less a story about sophisticated intrusion and more about a systemic governance failure that plagues nearly every organization running Microsoft 365 or Entra ID at scale. While human accounts typically get rotated passwords, conditional access policies, and MFA prompts, service accounts—created by IT for automation, shared mailbox access, or legacy application integration—frequently fall outside identity hygiene programs entirely.
The Non-Human Identity Blind Spot
Proofpoint's data shows the threat actor spray-tested default credentials across dormant service accounts because they represent the path of least resistance. Human users are forced into periodic password changes. Service accounts are not. Six of the seven compromises occurred within seven minutes of spraying, strongly suggesting a shared or predictable default password set rather than credential stuffing from a prior breach.
The fundamental issue: most organizations cannot produce a complete inventory of non-human identities in their Microsoft 365 environment, let alone enforce lifecycle controls on them.
The attackers leveraged TeamFiltration, a publicly available offensive framework designed specifically for enumerating, spraying, exfiltrating, and backdooring Entra ID accounts. Its availability means this attack pattern is replicable by any financially motivated actor with minimal technical skill—no zero-day required.
Why AWS EC2 Infrastructure Matters
The campaign originated from 1,487 unique AWS EC2 IP addresses. This is operationally significant for two reasons:
- Cloud-hosted infrastructure provides attackers with near-infinite IP rotation, rendering IP-based rate limiting and geo-fencing largely ineffective without more sophisticated behavioral analytics.
- AWS IP ranges are ubiquitous in legitimate enterprise traffic, making blanket blocking of EC2 source IPs impractical for most organizations.
This means traditional brute-force protections that rely on IP reputation or ASN-based blocking will struggle against cloud-infrastructure-borne spraying campaigns. Defenders need authentication-pattern analytics, not just network-layer controls.
Who Is Most Exposed
While this campaign targeted Chilean retail and financial sectors, the vulnerability pattern is universal. Organizations most at risk include:
Shield53 Recommendations
Defenders should treat non-human identity governance as a Tier 1 security priority, not an IT operations afterthought.
Immediate Actions
- Audit all service and functional accounts in Entra ID—export the full directory, filter for non-interactive sign-in patterns, and flag any account without MFA registration or a recent password rotation.
- Enforce MFA on every account including service accounts. Use workload identity and managed identities or certificate-based authentication where interactive MFA is not feasible. >
- Rotate all default-provisioned credentials immediately. Any account created with a standard onboarding password (e.g., "TempPass2024!") and never changed should be treated as already compromised. >
- Enable Microsoft Entra ID Protection and review sign-in risk events for service accounts showing high-volume authentication attempts from rotating IP ranges.
Strategic Actions
- Implement a non-human identity lifecycle policy: every service account must have a documented owner, expiration date, and access review cadence. >
- Deploy Conditional Access policies that block legacy authentication protocols entirely—TeamFiltration and similar tools often rely on protocols that bypass modern auth requirements. >
- Monitor for TeamFiltration-specific IOCs: unusual OAuth app consent patterns, mass email validation API calls, and OneDrive access from non-typical geographies or device fingerprints.
The UNK_CondorFiltration campaign confirms what identity security practitioners have warned for years: attackers don't need to defeat MFA when unmonitored service accounts offer an open door. The fix isn't more tooling—it's basic hygiene applied to the accounts nobody remembers.
