TeamFiltration Campaign Compromises Seven Microsoft 365 Accounts Using Default Passwords

Researchers have uncovered a TeamFiltration campaign, known as UNK_CondorFiltration, that has targeted over 5,700 Microsoft 365 accounts across 28 tenants. The campaign has primarily focused on retail and financial institutions in Chile. The attacks originated from 1,487 unique AWS EC2 source IP addresses. The campaign compromised seven Microsoft 365 accounts, with the compromise achieved using default passwords. The activity suggests that the attackers are exploiting weak passwords to gain access to targeted accounts. The campaign's use of default passwords highlights the vulnerability of accounts with easily guessable credentials.