Cybercriminals Use TeamFiltration Pentesting Framework to Breach Microsoft Teams, OneDrive, Outlook, and More

Proofpoint threat researchers have exposed an active account takeover (ATO) campaign, dubbed UNK_SneakyStrike, exploiting the TeamFiltration pentesting framework to target Microsoft Entra ID user accounts.

Since December 2024, this malicious operation has impacted over 80,000 user accounts across hundreds of organizations, achieving several successful breaches.

UNK_SneakyStrike Campaign

The attackers have weaponized TeamFiltration a tool originally designed for legitimate penetration testing and risk assessment to orchestrate large-scale user enumeration and password-spraying attacks.

By leveraging the Microsoft Teams API and Amazon Web Services (AWS) infrastructure across multiple regions, cybercriminals have gained unauthorized access to critical native applications such as Microsoft Teams, OneDrive, and Outlook, posing a significant threat to cloud security.

The TeamFiltration framework, first released publicly at DefCon30 in 2021, offers a suite of advanced capabilities that have made it a double-edged sword in the cybersecurity landscape.

It automates tactics like account enumeration to identify valid users, password spraying to compromise credentials, and data exfiltration to steal sensitive information such as emails and files.

Additionally, it facilitates persistent access through “backdooring” techniques, uploading malicious files to a target’s OneDrive to replace legitimate files with malware-laden lookalikes.

Sophisticated Account Takeover Tactics

Proofpoint researchers identified unique indicators of TeamFiltration misuse, including a distinctive, outdated Microsoft Teams user agent and suspicious access attempts to specific sign-in applications from incompatible devices, suggesting user agent spoofing to mask the origin of attacks.

Further analysis revealed that the tool targets a pre-configured list of Microsoft OAuth client application IDs to obtain “family refresh tokens,” which are then exploited for broader access across Entra ID environments.

The UNK_SneakyStrike campaign, peaking in January 2025, showcases a pattern of concentrated bursts of unauthorized access attempts, often targeting entire user bases in smaller cloud tenants while selectively focusing on subsets in larger ones.

These attacks, originating predominantly from AWS servers in the United States (42%), Ireland (11%), and Great Britain (8%), rotate across regions to evade detection.

Proofpoint distinguished this malicious activity from legitimate penetration testing by analyzing the indiscriminate, high-volume targeting patterns across multiple tenants.

The campaign’s reliance on a “sacrificial” Office 365 account with a Microsoft 365 Business Basic license for enumeration, combined with AWS infrastructure, underscores the sophistication of the operation.

As threat actors increasingly adopt advanced tools like TeamFiltration, Proofpoint warns of a shift away from less effective intrusion methods, urging organizations to bolster defenses with behavioral analytics and threat intelligence.

Indicators of Compromise (IOCs)

Find this News Interesting! Follow us on Google News, LinkedIn, and X to Get Instant Updates