SneakyStrike Scandal: 80,000 Microsoft Entra ID Accounts Hijacked by TeamFiltration Hackers!
Hackers are using the TeamFiltration framework to target over 80,000 Microsoft Entra ID accounts. The campaign, led by the threat actor UNK_SneakyStrike, has resulted in multiple account hijackings. Organizations should be wary and take steps to secure their systems against these crafty cyber-intruders.
Hot Take:
Who knew that hackers were such big fans of “Team Building” exercises? In their latest escapade, they’ve taken it a bit too literally by “building” their teams with over 80,000 Microsoft Entra ID accounts. At this rate, they’ll need an HR department to manage all the stolen identities!
Key Points:
- Hackers exploit TeamFiltration to target over 80,000 Microsoft Entra ID accounts.
- The campaign, led by UNK_SneakyStrike, peaked on January 8 with 16,500 accounts targeted in a single day.
- TeamFiltration, published in 2022, is a red-team tool used for large-scale attacks on Office 365 accounts.
- Proofpoint researchers traced the attacks to specific user agents and OAuth client IDs used by TeamFiltration.
- Organizations are advised to block suspicious IPs, enable multi-factor authentication, and enforce OAuth 2.0.
Already a member? Log in here