Executive Summary
Since December 2024, a threat actor identified as UNK_SneakyStrike has targeted over 80,000 Microsoft Entra ID accounts across hundreds of global organizations. The campaign reached a peak on January 8, 2025, with over 16,500 accounts targeted in a single day. The activity is characterized by sharp bursts of high-volume spraying followed by periods of dormancy to evade detection.
The attackers utilize TeamFiltration, a publicly available penetration testing framework, to automate account enumeration and credential spraying. The campaign leverages Amazon Web Services (AWS) infrastructure primarily located in the United States, Ireland, and the United Kingdom. By using a sacrificial Office 365 Business Basic account, the actor interacts with the Microsoft Teams API to validate and enumerate potential targets before launching broader attacks.
This campaign poses a significant risk for account takeover (ATO) and subsequent data exfiltration. The use of legitimate pentesting tools and cloud-based infrastructure allows the actor to bypass traditional geographic-based blocking and legacy monitoring systems, making it a high priority for enterprise defenders.