Malware

TeamFiltration

TeamFiltration is an open-source tool for Microsoft Entra ID and Microsoft 365 designed for enumeration, password spraying, and exfiltration. The provided content describes it as a penetration testing framework publicly released by Melvin "Flangvik" Langvik in August 2022 at DEF CON, and notes that defenders detect it via characteristic user-agent strings in Azure/M365 sign-in and audit logs. TeamFiltration has been linked to large-scale account takeover activity against Microsoft cloud environments, including a campaign reported by Proofpoint as UNK_SneakyStrike. In that activity, attackers used TeamFiltration together with the Microsoft Teams API and geographically distributed AWS infrastructure to enumerate users and conduct password spraying against Microsoft Entra ID accounts. The campaign targeted more than 80,000 users across hundreds of organizations or nearly 100 cloud tenants beginning in December 2024. Successful compromises resulted in access to Microsoft cloud resources and native applications including Microsoft Teams, OneDrive, and Outlook. High-confidence indicators mentioned in the content include TeamFiltration-specific user-agent strings observed in Entra ID sign-in and audit logs.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

16 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1078Valid AccountsEvidence2

"All 7 successfully compromised accounts were unmanaged functional/service accounts" and the attacker authenticated to Microsoft Teams after password spraying.

T1078.004Cloud AccountsEvidence2

“The campaign compromised 7 accounts – all of which were unmanaged functional or service accounts rather than individual employee accounts.”

Persistence

3 techniques

T1078Valid AccountsEvidence2

"All 7 successfully compromised accounts were unmanaged functional/service accounts" and the attacker authenticated to Microsoft Teams after password spraying.

T1078.004Cloud AccountsEvidence2

“The campaign compromised 7 accounts – all of which were unmanaged functional or service accounts rather than individual employee accounts.”

T1098Account ManipulationEvidence1

“Backdooring” via OneDrive: Enables persistent access and potential lateral movement by uploading malicious files to the target’s OneDrive and replacing existing files (e.g., on the desktop) with lookalikes.

Privilege Escalation

3 techniques

T1078Valid AccountsEvidence2

"All 7 successfully compromised accounts were unmanaged functional/service accounts" and the attacker authenticated to Microsoft Teams after password spraying.

T1078.004Cloud AccountsEvidence2

“The campaign compromised 7 accounts – all of which were unmanaged functional or service accounts rather than individual employee accounts.”

T1098Account ManipulationEvidence1

Stealth

3 techniques

T1036MasqueradingEvidence1

This unexpected behavior indicates user agent spoofing and is meant to obfuscate the real client or device from which the intrusion originated.

T1078Valid AccountsEvidence2

"All 7 successfully compromised accounts were unmanaged functional/service accounts" and the attacker authenticated to Microsoft Teams after password spraying.

T1078.004Cloud AccountsEvidence2

“The campaign compromised 7 accounts – all of which were unmanaged functional or service accounts rather than individual employee accounts.”

Credential Access

3 techniques

T1110Brute ForceEvidence1

"...high volume of failed interactive or non-interactive authentication attempts... indicative of password spraying, credential stuffing, or password guessing."

T1110.003Password SprayingEvidence3

“Evidence indicates that the threat actor likely sprayed accounts with default passwords, including credentials provisioned by IT teams and never rotated.”

T1649Steal or Forge Authentication CertificatesEvidence1

Those refresh tokens can then be exchanged for valid bearer tokens, like any other client in the family, and subsequently leveraged for access exploitation.

Discovery

3 techniques

T1087Account DiscoveryEvidence3

TeamFiltration is designed for “enumerating, spraying, exfiltrating, and backdooring” Entra ID accounts and “allows an operator to validate email accounts [and] test common or targeted passwords across enumerated accounts.”

T1526Cloud Service DiscoveryEvidence1

After compromise, the attacker accessed "Azure Portal," "OfficeHome," and "SharePoint Online."

T1538Cloud Service DashboardEvidence1

The post-access sequence included "Azure Portal access" and "M365 Portal access."

Collection

3 techniques

T1114.002Remote Email CollectionEvidence1

TeamFiltration's Exfiltrate module "harvests email, Teams chats, OneDrive/SharePoint files," and Microsoft Office access was identified as "Email and calendar exfiltration (Outlook REST)."

T1213Data from Information RepositoriesEvidence1

TeamFiltration can collect "Teams chats" and accessed Microsoft Teams across all seven compromised accounts.

T1530Data from Cloud StorageEvidence2

“Across most of the compromised accounts, the threat actor leveraged the foothold to access Microsoft Office, OneDrive, and Teams, potentially indicative of data harvesting and exfiltration. That said, sign-in events alone cannot be taken as evidence of exfiltration.”

Command and Control

1 technique

T1090ProxyEvidence2

“Less than 2 minutes after successful compromise, the operator has been observed pivoting to a German VPN node to probe the corporate VPN, access Azure Portal, browse SharePoint Online, and initiate Microsoft Graph API token requests.”

Exfiltration

1 technique

T1567Exfiltration Over Web ServiceEvidence1

Data exfiltration: Extracts information such as emails, files, and other valuable data.

Impact

1 technique

T1565.001Stored Data ManipulationEvidence1

TeamFiltration's Backdoor module can "silently replace files," allowing an attacker to plant malicious files in place of legitimate ones and trigger execution when opened.

INDICATORS OF COMPROMISE

IOCs tracked for this family

15 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

12 tracked

IPs, domains, and DNS infrastructure linked to this family.

Other

3 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

cidr.v4●●●●●●●●●●●●View more in app11 days ago

ip.v4●●●●●●●●●●●●View more in app11 days ago

ip.v4●●●●●●●●●●●●View more in app1 year ago

ACTIVITY FEED

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

4 SOURCESView more in app

detections digest rulecheckNews

Jul 14, 2025

Detections Digest #20250714

An attacker tool used against Microsoft 365/Azure environments for account enumeration and password spraying; detectable via characteristic user-agent strings in sign-in/audit telemetry.

cert eu threat intelNews

Jan 7, 2025

Cyber Brief 25-07 - June 2025

Open-source penetration testing framework abused for automated account takeover, credential harvesting, and lateral movement in cloud environments.

the hacker newsNews

Dec 4, 2025

Amazon Web Services — Latest News, Reports & Analysis | The Hacker News

TeamFiltration is an open-source penetration testing tool that has been abused by attackers to conduct account takeover campaigns, specifically targeting Microsoft Entra ID accounts through user enumeration and password spraying.

elastic security labsNews

Mar 18, 2026

Prebuilt rule reference | Elastic Security [8.19] | Elastic

An open-source tool used to enumerate Entra ID/M365 tenants, perform password spraying, and facilitate data access/exfiltration activities; detectable via characteristic user-agent strings in sign-in/audit logs.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching15

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping16

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

TeamFiltration