Spraying in the Andes: TeamFiltration Returns to Exploit Forgotten Service Accounts

MITRE Techniques

• [T1110.003] Password Spraying – The attacker tested common or default passwords across many accounts in bulk, yielding compromises on dormant service accounts (‘The attacker likely sprayed accounts with default passwords’ and ‘initial compromise via password spray’).
• [T1580] Cloud Infrastructure Discovery – TeamFiltration enumerated accounts and validated their existence through Microsoft 365/Teams services (‘Validates account existence at ~300 emails/sec via the Teams API’).
• [T1078.004] Valid Accounts: Cloud Accounts – The attacker used successfully guessed credentials to sign in to Microsoft 365 accounts (‘All 7 successfully compromised accounts were unmanaged functional/service accounts’).
• [T1021.002] Remote Services: SMB/Cloud Services Access? – The attacker accessed cloud services after login, including Azure Portal and SharePoint Online (‘accessed several Azure apps, including OfficeHome, Azure Portal, and SharePoint Online’).
• [T1213] Data from Information Repositories – TeamFiltration auto-exfiltrated email, chats, and files from Microsoft 365 repositories (‘harvests email, Teams chats, OneDrive/SharePoint files, and Graph API data automatically’).
• [T1105] Ingress Tool Transfer – The backdoor mode could plant or replace files on OneDrive to trigger later execution (‘silently replace files… enabling an attacker to plant malicious files’).
• [T1021.007] Remote Services: Cloud Services – The attacker probed the corporate VPN, Azure Portal, and Microsoft 365 portals from a German VPN node (‘began a post-access sequence: probing the corporate VPN, accessing Azure Portal, browsing SharePoint’).
• [T1528] Steal Application Access Token – The SharePoint Online Web Client Extensibility activity requested an access token for Microsoft Graph or external APIs (‘requested an access token to interact with Microsoft Graph or external APIs’).