UNK_CondorFiltration: Microsoft 365 Accounts Compromised via Default Passwords

Introduction

Recent cybersecurity intelligence has uncovered a sophisticated phishing operation dubbed UNK_CondorFiltration, which has systematically breached multiple Microsoft 365 environments by exploiting weak authentication credentials. According to Proofpoint, this campaign—a coordinated effort spanning over 5,700 compromised accounts across 28 distinct tenants—has specifically targeted organizations within Chilean retail and financial sectors. The attack vector relied heavily on default account passwords, allowing malicious actors to gain unauthorized access before deploying further malicious activities.

This incident represents a significant escalation in credential-based attacks against cloud-native platforms, highlighting both the importance of strong password hygiene and the growing sophistication of threat groups that leverage default configurations as entry points into enterprise networks.

Campaign Overview: UNK_CondorFiltration in Detail

The UNK_CondorFiltration operation appears to have been launched from a distributed network of sources, with 1,487 unique AWS EC2 instance IP addresses identified as origin points. This large-scale distribution strategy suggests the attackers employed a multi-vector approach to maximize reach while minimizing detection risk. By leveraging compromised or unsecured instances in the AWS ecosystem, they were able to generate numerous initial compromise attempts that converged on high-value target accounts.

• Target Scope: Over 5,700 Microsoft 365 accounts affected
• Primary Victims: Chilean retail businesses and financial institutions
• Source Network: 1,487 unique AWS EC2 source IP addresses
• Compromised Accounts: 7 individual accounts successfully penetrated

Attack Methodology: Exploitation of Default Credentials

A core component of the UNK_CondorFiltration campaign was the systematic exploitation of default passwords across Microsoft 365 tenant environments. By automating credential guessing and credential stuffing techniques, the attackers bypassed standard security controls designed to require strong, unique passwords at signup time. Once access was obtained through these vulnerable accounts, threat actors likely conducted lateral movement within each tenant, potentially compromising additional resources such as Exchange Online mailboxes, SharePoint sites, or OneDrive files.

This methodology underscores a critical gap in many organizations' adoption practices: the failure to enforce mandatory complex password policies and regular password rotation. Default passwords remain a persistent vulnerability, especially when organizations fail to change them during routine setup procedures or when staff training programs do not adequately emphasize the risks associated with publicly exposed credentials.

Broader Implications for Enterprise Security

The UNK_CondorFiltration incident serves as a cautionary example of how default password abuse can cascade into widespread credential compromise. Beyond the immediate impact on the seven affected accounts, successful penetration could open doors to sensitive business data, intellectual property, and customer information. Organizations in the targeted sectors may face regulatory penalties under data protection laws if personal or financial information is exposed. Moreover, attackers who breach these accounts often use them as footholds to move laterally toward more valuable systems, including payment processing platforms or internal management tools.

For organizations outside the immediate scope of this campaign, the lesson is clear: every account should be treated as potentially vulnerable. Regular audits of password complexity, implementation of MFA, and monitoring of unusual login patterns can help mitigate the risk of similar attacks. Additionally, maintaining inventory of all cloud endpoints and understanding their exposure helps in building a defense-in-depth posture that anticipates and resists credential-based intrusions.

Conclusion

As the UNK_CondorFiltration campaign continues to unfold, organizations must remain vigilant against the pervasive threat of default password exploitation. The ability of attackers to scale their operations through distributed AWS infrastructure highlights the need for robust access control measures and proactive security awareness training. With cloud migration accelerating across industries, strengthening fundamental security practices—particularly around authentication and credential management—becomes not just a best practice but a necessity for protecting digital assets and maintaining operational continuity.