Actor Profile

UNK_CondorFiltration is a threat cluster attributed by Proofpoint, conducting password spray campaigns against Microsoft 365 tenants. The actor's motivation appears to be credential harvesting and data exfiltration from cloud environments, with a specific focus on Chilean retail and financial sectors. The campaign leveraged TeamFiltration, an open-source offensive framework for Entra ID enumeration, spraying, and backdooring. The actor demonstrated operational sophistication by distributing attacks across 1,487 unique AWS EC2 IP addresses and pivoting through German VPN nodes post-compromise. Origin and attribution details remain limited beyond the Proofpoint cluster designation.

TTPs (Tactics, Techniques, Procedures)

The campaign employed password spraying (T1110.003) against Microsoft 365 tenants, targeting unmanaged service accounts with default or unrotated credentials. The actor used TeamFiltration for valid account enumeration (T1087.004) and credential access. Post-compromise, the threat actor accessed cloud services including Microsoft Office, OneDrive, Teams, SharePoint Online, and Azure Portal, likely for data collection (T1530). The actor initiated Microsoft Graph API token requests and pivoted through VPN infrastructure (German nodes) within 2 minutes of compromise to probe corporate VPN endpoints. Six of seven accounts were compromised within 7 minutes, indicating automated spraying of shared default passwords rather than targeted credential stuffing.

Targets & Patterns

UNK_CondorFiltration primarily targeted Chilean retail and financial institutions, compromising over 5,700 accounts across 28 Microsoft 365 tenants. The campaign unfolded in three waves (July 21-August 16, 2026): Wave 1 targeted two major Chilean banks (100-120 accounts/day), Wave 2 targeted another Chilean financial institution (peak 1,520 accounts on July 27), and Wave 3 targeted a major Chilean retailer (peak 1,560 accounts on August 15, resulting in 7 compromises). One unnamed Chilean retailer accounted for 78.3% of all authentication events. The actor specifically exploited unmanaged functional and service accounts—dormant identities provisioned for business operations but left unmonitored with original default credentials and no MFA enforcement. This targeting pattern suggests reconnaissance of organizational identity infrastructure to identify non-human accounts outside standard security controls.

Historical Context

TeamFiltration has been weaponized in previous campaigns. In June 2025, Proofpoint documented another threat cluster, UNK_SneakyStrike, which targeted over 80,000 user accounts across hundreds of cloud tenants using the same open-source framework. The UNK_CondorFiltration campaign represents a continuation of adversary adoption of legitimate penetration testing tools for cloud identity attacks, with a shift toward exploiting service account hygiene gaps rather than phishing individual employees. The geographic focus on Chile and the financial/retail sectors in this campaign distinguishes it from the broader, multi-sector targeting observed in UNK_SneakyStrike.

Defensive Recommendations

  • Implement mandatory MFA on all accounts including service, functional, and non-human identities to prevent password spray success (T1110.003)
  • Enforce password rotation policies for service accounts and eliminate default credentials provisioned by IT teams; audit all unmanaged accounts for credential hygiene
  • Monitor for rapid authentication attempts from cloud infrastructure IP ranges (AWS EC2, Azure, GCP) and implement conditional access policies restricting sign-ins from unexpected geographies
  • Detect anomalous Microsoft Graph API token requests and post-compromise pivoting behavior (e.g., VPN probing, Azure Portal access from foreign IPs within minutes of initial sign-in)
  • Deploy identity threat detection for TeamFiltration indicators: enumeration patterns, OneDrive access from offensive tooling user-agents, and SharePoint browsing immediately following authentication events

---

# Geopolitical Context

Geopolitical Context

The UNK_CondorFiltration campaign represents a focused intrusion effort against Chilean economic infrastructure, specifically targeting retail and financial institutions that underpin the country's commercial ecosystem. The concentration on Chile—a stable, market-oriented economy and key U.S. partner in Latin America—suggests either regional criminal interest in financial data or strategic intelligence collection targeting economic decision-making. The campaign's methodical waves across July-August 2026, combined with rapid post-compromise pivoting to corporate VPN and Azure infrastructure, indicate operational sophistication beyond opportunistic credential stuffing. The exploitation of unmanaged service accounts reflects an understanding of enterprise identity hygiene gaps common across organizations undergoing digital transformation. Chile's integration into global financial networks and its role as a regional economic hub may make its institutions attractive targets for both financially motivated actors and state-aligned groups seeking economic intelligence on Latin American markets, trade flows, or corporate strategy.

State Actor Alignment

No attribution to state actors has been disclosed by researchers. The campaign's use of AWS EC2 infrastructure and German VPN nodes for post-compromise activity complicates infrastructure-based attribution. The focus on Chilean financial and retail sectors could align with either cybercriminal objectives (financial fraud, business email compromise, data theft for resale) or state-sponsored economic espionage. Chile's geopolitical position—including its lithium reserves critical to global energy transition, copper exports, and Pacific Alliance trade relationships—could make its financial institutions targets for foreign intelligence services seeking economic insight. However, the reliance on default password spraying and publicly available offensive tools (TeamFiltration) is consistent with both moderately resourced criminal groups and lower-tier state-aligned actors. Without further technical indicators or operational tradecraft linking UNK_CondorFiltration to known threat groups, the actor's sponsorship and strategic intent remain unclear.

Business Impacty pro region

For Latin America, this campaign underscores persistent cyber risk to the region's financial sector, which has rapidly adopted cloud services while often lagging in identity governance maturity. Chilean institutions' compromise may provide adversaries with access to cross-border transaction data, corporate intelligence on regional trade, or credentials enabling further supply chain intrusion across Latin American partners. The targeting of major banks and retailers could facilitate financial fraud, business email compromise schemes, or pre-positioning for future disruptive operations. Globally, the incident highlights systemic vulnerabilities in Microsoft 365 tenant security across emerging markets, where service account hygiene and MFA adoption remain inconsistent. European financial institutions with Chilean exposure or correspondent banking relationships may face secondary risk if compromised credentials enable lateral movement or social engineering. The use of AWS infrastructure for malicious activity reinforces ongoing policy debates in the U.S. and EU regarding cloud provider responsibility for abuse mitigation and the need for enhanced visibility into infrastructure-as-a-service misuse by threat actors.

Forecast

If UNK_CondorFiltration or similar actors continue exploiting unmanaged service accounts, Chilean financial institutions are likely to face sustained credential-based intrusion attempts, particularly if default password hygiene and MFA enforcement remain inconsistent. Should compromised accounts enable data exfiltration or financial fraud, affected institutions may face regulatory scrutiny under Chile's data protection framework and potential reputational damage impacting customer trust. If the campaign expands beyond Chile, other Latin American economies with comparable cloud adoption patterns—including Colombia, Peru, and Mexico—may experience similar targeting of financial and retail sectors. Regional banking regulators may respond with enhanced identity security mandates, accelerating MFA requirements for service accounts and cloud tenant monitoring. If the threat actor's identity or sponsorship becomes clearer, geopolitical responses could range from law enforcement coordination (if criminal) to diplomatic friction (if state-aligned). Absent improved identity governance, organizations globally relying on Microsoft 365 and similar cloud platforms will likely continue facing exploitation of forgotten service accounts, sustaining this attack vector's viability for both criminal and espionage operations.