{"id":244478,"date":"2026-09-25T01:22:51","date_gmt":"2026-09-25T06:22:51","guid":{"rendered":"https:\/\/lifeboat.com\/blog\/2026\/09\/teamfiltration-campaign-compromises-seven-microsoft-365-accounts-using-default-passwords"},"modified":"2026-09-25T01:22:51","modified_gmt":"2026-09-25T06:22:51","slug":"teamfiltration-campaign-compromises-seven-microsoft-365-accounts-using-default-passwords","status":"publish","type":"post","link":"https:\/\/lifeboat.com\/blog\/2026\/09\/teamfiltration-campaign-compromises-seven-microsoft-365-accounts-using-default-passwords","title":{"rendered":"TeamFiltration Campaign Compromises Seven Microsoft 365 Accounts Using Default Passwords"},"content":{"rendered":"<p><a class=\"aligncenter blog-photo\" href=\"https:\/\/lifeboat.com\/blog.images\/teamfiltration-campaign-compromises-seven-microsoft-365-accounts-using-default-passwords.jpg\"><\/a><\/p>\n<p>Cybersecurity researchers have disclosed details of an active TeamFiltration campaign codenamed <strong><a href=\"https:\/\/www.proofpoint.com\/us\/blog\/threat-insight\/Spraying-in-the-Andes-TeamFiltration-Returns\" target=\"_blank\">UNK_CondorFiltration<\/a><\/strong> that has targeted over 5,700 accounts across 28 Microsoft 365 tenants.<\/p>\n<p>According to Proofpoint, the activity has primarily focused on Chilean retail and financial institutions. It originated from 1,487 unique AWS EC2 source IP addresses.<\/p>\n<p>\u201cThe campaign compromised 7 accounts \u2013 all of which were unmanaged functional or service accounts rather than individual employee accounts \u2013 highlighting a critical exposure gap around forgotten, non-human identities carrying default or unrotated passwords and no MFA [multi-factor authentication],\u201d the enterprise security company said in a statement.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Cybersecurity researchers have disclosed details of an active TeamFiltration campaign codenamed UNK_CondorFiltration that has targeted over 5,700 accounts across 28 Microsoft 365 tenants. According to Proofpoint, the activity has primarily focused on Chilean retail and financial institutions. It originated from 1,487 unique AWS EC2 source IP addresses. \u201cThe campaign compromised 7 accounts \u2013 all of [\u2026]<\/p>\n","protected":false},"author":427,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[34,45],"tags":[],"class_list":["post-244478","post","type-post","status-publish","format-standard","hentry","category-cybercrime-malcode","category-finance"],"_links":{"self":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/244478","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/users\/427"}],"replies":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/comments?post=244478"}],"version-history":[{"count":0,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/244478\/revisions"}],"wp:attachment":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/media?parent=244478"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/categories?post=244478"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/tags?post=244478"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}