Executive Summary
Proofpoint researchers identified an active brute-force campaign, tracked as UNK_CondorFiltration, targeting over 5,700 accounts across 28 Microsoft 365 tenants, primarily in Chile. The campaign focuses on financial and retail sectors, achieving compromises specifically against forgotten or unmanaged service accounts that utilize default, unrotated passwords and lack Multi-Factor Authentication (MFA).
The attackers utilize the TeamFiltration offensive framework to automate account enumeration, password spraying via AWS-based proxies (FireProx), and automated exfiltration of emails, Teams chats, and OneDrive files. While personal employee accounts resisted the spray due to password rotation policies, service accounts—often overlooked in security audits—provided a successful entry point for further reconnaissance into corporate VPNs and Azure portals.
This campaign highlights the critical risk posed by dormant functional accounts. Organizations in Latin America, particularly those in the retail and banking sectors, should immediately audit service accounts for legacy authentication protocols, lack of MFA, and default credential sets to mitigate the risk of account takeover and data exfiltration.