Cyber Attacks on Microsoft 365: TeamFiltration Campaign

Cybersecurity researchers have released details about an active campaign codenamed UNK_CondorFiltration, which has targeted over 5,700 accounts across 28 Microsoft 365 tenants. According to Proofpoint, the activity primarily focused on retail and financial institutions in Chile. The attacks were initiated from 1,487 unique AWS EC2 source IP addresses. The campaign successfully compromised seven accounts by targeting default passwords. This method is particularly concerning as it highlights a widespread security vulnerability that exists in many organizations.

The attackers utilized automated tools to guess passwords and gain access to the accounts. The affected organizations in Chile are mainly involved in retail and the financial sector. These sectors are often targets of cyber attacks due to their management of sensitive data and often less robust security measures. The attackers appear to be specifically searching for vulnerabilities in the security protocols of these companies. Proofpoint has noted that the attacks are not limited to Chile but could also affect other regions if similar security gaps are present.

The use of default passwords is a widespread issue that affects many companies, regardless of their size or industry. Security researchers recommend that organizations review their password policies and ensure that all accounts are secured with strong, unique passwords. Additionally, multi-factor authentication and regular employee training to raise awareness of cyber threats should be implemented. The UNK_CondorFiltration campaign is an example of the increasing complexity and sophistication of cyber attacks. Attackers often use automated systems to exploit vulnerabilities in IT infrastructure.

The fact that over 5,700 accounts are affected underscores the scale of the threat. The security situation in Chile has gained importance in recent years as more companies undergo digital transformations. These changes bring new risks that can be exploited by cybercriminals. The Chilean government has already taken measures to improve cybersecurity; however, the challenge remains. Another aspect of the campaign is the origin of the attacks.

The use of AWS EC2 IP addresses indicates that the attackers may be operating through cloud services, complicating traceability. This presents an additional challenge for security authorities trying to identify and hold the perpetrators accountable. The incidents have also sparked discussions about the responsibility of cloud providers. It is expected that companies offering cloud services will take proactive measures to protect their customers from such attacks. The security community is calling for stronger collaboration between businesses and cloud service providers to enhance security standards.

The UNK_CondorFiltration campaign is a troubling example of the ongoing threats in cybersecurity. Companies are urged to rethink their security strategies and adapt to the ever-evolving tactics of cybercriminals. According to Proofpoint, the attacks are a clear indication that the threat landscape must be taken seriously. Proofpoint's security researchers have identified the campaign as one of the largest threats to Microsoft 365 users. The attacks have the potential to cause significant damage if not detected and stopped in a timely manner.

Therefore, companies should urgently review and adjust their security measures. The campaign was first identified in September 2026 and has since intensified. Researchers warn that similar attacks could occur in other regions if appropriate security measures are not implemented. The need for companies to prepare against such threats is more urgent than ever.