The record
Written from the 1 report below. Nothing here is unsourced.
- The UNK_CondorFiltration campaign targeted over 5,700 accounts across 28 Microsoft 365 tenants using an offensive framework called TeamFiltration.
- Threat actors exploited unmanaged service accounts that relied on default or non-rotated passwords and lacked multi-factor authentication.
- Attackers successfully compromised seven of these accounts, which primarily belonged to retail and financial institutions in Chile.
- This activity highlights the significant security risk posed by forgotten or unmonitored service accounts within enterprise environments.
What to watch next
- Monitoring of unmanaged or forgotten service accounts for default credentials
- Implementation of mandatory multi-factor authentication across all cloud accounts
- Periodic rotation of credentials for non-human service identities
Who said what1
Only words found exactly in the article are shown, attributed and linked to the line they came from.
Proofpoint
enterprise security company
1 quote · 1 outlet
“The campaign compromised 7 accounts – all of which were unmanaged functional or service accounts rather than individual employee accounts – highlighting a critical exposure gap around forgotten, non-human identities carrying default or unrotated passwords and no MFA [multi-factor authentication]”
In the article
…5,700 accounts across 28 Microsoft 365 tenants. According to Proofpoint, the activity has primarily focused on Chilean retail and financial institutions. It originated from 1,487 unique AWS EC2 source IP addresses. " The campaign compromised 7 accounts – all of which were unmanaged functional or service accounts rather than individual employee accounts – highlighting a critical exposure gap around forgotten, non-human identities carrying default or unrotated passwords and no MFA [multi-factor authentication] ," the enterprise security company said in a statement. The Microsoft 365 brute-force campaign is said to have unfolded across three different waves from late July to August 2026, with an unnamed Chilean retailer facing…
Coverage1
All filed from India
Named Chile · Germany · Microsoft · Amazon Web Services · Proofpoint · TeamFiltration
The 1 report is listed beside the record.
Ask this story
Answers cite the reports above, or say they can't.