Spraying in the Andes: TeamFiltration Returns to Exploit Forgotten Service Accounts
UNK_CondorFiltration used TeamFiltration to password-spray 5,700+ M365 accounts across 28 Chilean tenants, compromising 7 dormant service accounts with default passwords and no MFA for data exfiltration. The attacker leveraged 1,487 AWS EC2 IPs to enumerate accounts at 300/sec via Teams API before spraying passwords, rotating AWS regions through FireProx. All 7 compromises hit unmanaged service accounts lacking MFA and prior login history. Post-access included German VPN pivoting, corporate VPN probing, and SharePoint reconnaissance matching TeamFiltration's auto-exfil and backdoor capabilities.
Detection / Hunteropenrouter
Immediate Actions
- Audit all M365 service and functional accounts for MFA enrollment status
- Force password rotation on all dormant accounts with no recent login activity
- Block listed AWS IP ranges and 149.88.104.19 from M365 authentication
- Search M365 sign-in logs for the TeamFiltration user agent string
Key Takeaways
- Six of seven accounts compromised within 7 minutes, indicating shared default password provisioning.
- TeamFiltration's hardcoded user agent from 2020 Teams client is a reliable detection artifact.
- Campaign ran in three bursts over 26 days (Jul 21–Aug 16) with a two-week silence between waves.
- Corporate VPN probe from German IP was blocked by MFA/conditional access despite account having no MFA.
- One major retailer accounted for 78.3% of events and all 7 confirmed compromises.
Attack Chain
- Reconnaissance: Enumerate valid M365 accounts via Teams API at ~300 emails/sec without lockouts
- Initial Access: Password spray from 1,487 AWS EC2 IPs against dormant service accounts with default passwords
- Defense Evasion: Switched to German VPN (149.88.104.19) within 90 seconds of successful compromise
- Discovery: Probed corporate VPN, accessed Azure Portal, browsed SharePoint Online
- Collection: TeamFiltration auto-exfil accessed email, Teams chats, OneDrive, and SharePoint files
- Exfiltration: Graph API token requested; potential automated exfiltration of email, chats, and files
Affected Systems
- Microsoft 365 tenants (28 targeted, primarily in Chile)
- Azure AD / Entra ID identity infrastructure
- Service and functional accounts without MFA
- SharePoint Online and OneDrive
- Microsoft Teams
- Corporate VPN portals with SAML authentication
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | Cloud identity attack; EDR lacks M365 sign-in and Teams API telemetry |
| Network Visibility | Medium | IP connections visible but traffic to legitimate M365/AWS endpoints |
| Detection Difficulty | Moderate | Distinctive user agent helps; AWS IP ranges and dormant account behavior require context |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| M365 sign-ins from AWS IP ranges with legacy Teams user agent (Teams/1.3.00.30866) indicate TeamFiltration password spraying (T1110.003) | M365 unified sign-in logs with user agent and source IP | Initial Access | Low — legacy user agent is unique to TeamFiltration |
| Service accounts with no prior login history accessing SharePoint, OneDrive, or Azure Portal indicate compromise (T1078.004) | Azure AD/Entra ID sign-in and access logs | Persistence | Medium — legitimate service account activity may trigger |
| Sign-in from AWS EC2 IP followed by German VPN node within minutes suggests post-compromise pivoting (T1090.002) | M365 sign-in logs with IP geolocation and timing | Defense Evasion | Low — rapid IP source change is anomalous for service accounts |
| Microsoft Graph API token requests from dormant service accounts indicate automated data collection (T1528) | Azure AD audit logs for token issuance events | Collection | Low — dormant accounts rarely request Graph tokens |
Required Log Sources
- M365 unified sign-in logs (user agent, IP)
- Azure AD/Entra ID audit and access logs
- SharePoint Online access and audit logs
- Teams activity logs
- Corporate VPN authentication logs
- Azure AD conditional access logs
Key Behavioral Indicators
- Legacy Teams user agent string (Teams/1.3.00.30866) in M365 sign-in logs
- Service accounts with no prior sign-in history accessing SharePoint or Azure Portal
- Sign-in from AWS EC2 IP followed by German VPN within minutes
- Microsoft Graph API token requests from dormant functional accounts
- Corporate VPN auth attempts from non-corporate IPs using service account credentials
- Rapid sequential access to Teams, Office, and OneDrive matching auto-exfil pattern
Control Gaps
- Service accounts without MFA enforcement remain exploitable via password spray
- Default password provisioning without forced rotation creates persistent exposure
- No alerting for dormant accounts with first-ever sign-in from new geo
- AWS EC2 IP reputation not blocked for M365 authentication
- Teams API account enumeration not detected or rate-limited
False Positive Assessment
Medium — AWS EC2 IP ranges are shared by legitimate services; user agent and behavioral patterns reduce false positives with context
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Enforce MFA on all M365 accounts including service and functional accounts
- Implement conditional access policies blocking auth from unmanaged IP ranges
- Disable legacy authentication protocols for service accounts
- Configure Teams API rate limiting to prevent account enumeration
User Protection
- Inventory and assign ownership to all service accounts in the tenant
- Monitor dormant accounts for any sign-in activity and alert on first login
- Implement automated password rotation for service accounts
- Review Azure Portal access logs for service account authentication
Security Awareness
- Train IT staff on risks of default password provisioning for service accounts
- Establish policy requiring MFA on all accounts regardless of type
- Document and review service account lifecycle from provisioning through retirement
MITRE ATT&CK Mapping
Resource Development
Initial Access
Credential Access
Discovery
Collection
Command and Control
Exfiltration
Impact
Plain-Language Summary
Attackers used a hacking tool called TeamFiltration to guess passwords on over 5,700 Microsoft 365 accounts belonging to Chilean organizations. They succeeded with 7 accounts that were set up for automated tasks but never had their default passwords changed or multi-factor authentication enabled. After breaking in, the attackers explored corporate networks, browsed SharePoint files, and may have downloaded emails and documents. Organizations should identify and secure all forgotten service accounts by enabling multi-factor authentication and rotating passwords.
Additional IOCs
- Other:
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Teams/1.3.00.30866 Chrome/80.0.3987.165 Electron/8.5.1 Safari/537.36- TeamFiltration hardcoded user agent from 2020 Teams client
- ip149[.]88[.]104[.]19Post-access German VPN for VPN probing, Azure Portal, SharePoint recon
- ip3[.]101[.]157[.]240Initial compromise IP for password spray via TeamFiltration