TeamFiltration Campaign Compromises Seven Microsoft 365 Accounts Using Default Passwords

Proofpoint researchers have disclosed details of an active campaign codenamed UNK_CondorFiltration, also tracked as TeamFiltration, that has targeted over 5,700 Microsoft 365 accounts across 28 tenants. The activity has primarily focused on Chilean retail and financial institutions. According to the report, the threat actor leveraged default passwords to gain initial access, successfully compromising seven accounts. The campaign originated from 1,487 unique AWS EC2 source IP addresses. Proofpoint has not attributed the activity to a specific threat actor group beyond the UNK_CondorFiltration moniker. The exact scope of the seven compromised accounts and the nature of data accessed remain under investigation. The report emphasizes that the use of default passwords represents a credential stuffing pattern consistent with observed tactics, though Proofpoint states there is no evidence of a broader exploit chain or phishing component in the initial access method.