An extensive account takeover (ATO) campaign targeting Microsoft Entra ID has been identified by cybersecurity experts, exploiting a powerful open-source penetration testing framework known as TeamFiltration.
First detected in December 2024, the campaign has accelerated rapidly, compromising more than 80,000 user accounts across many cloud environments over the past several years. It is a sophisticated and stealthy attack operation aimed at breaching enterprise cloud infrastructure that has been identified by the threat intelligence firm Proofpoint with the codename UNK_SneakyStrike, a sophisticated and stealthy attack operation.
UNK_SneakyStrike stands out due to its distinctive operational pattern, which tends to unfold in waves of activity throughout a single cloud environment often targeting a broad spectrum of users. The attacks usually follow a period of silent periods lasting between four and five days following these aggressive bursts of login attempts, a tactic that enables attackers to avoid triggering traditional detection mechanisms while maintaining sustained pressure on organizations' defence systems.
Several technical indicators indicate that the attackers are using TeamFiltration—a sophisticated, open-source penetration testing framework first introduced at the Def Con security conference in 2022—a framework that is highly sophisticated and open source. As well as its original purpose of offering security testing and red teaming services in enterprises, TeamFiltration is now being used by malicious actors to automate large-scale user enumeration, password spraying, and stealthy data exfiltration, all of which are carried out on a massive scale by malicious actors.
To simulate real-world account takeover scenarios in Microsoft cloud environments, this tool has been designed to compromise Microsoft Entra ID, also known as Azure Active Directory, in an attempt to compromise these accounts. It is important to know that TeamFiltration's most dangerous feature is its integration with the Microsoft Teams APIs, along with its use of Amazon Web Services (AWS) cloud infrastructure to rotate the source IP addresses dynamically.
Not only will this strategy allow security teams to evade geofencing and rate-limiting defences, but also make attribution and traffic filtering a significant deal more challenging. Additionally, the framework features advanced functionalities that include the ability to backdoor OneDrive accounts so that attackers can gain prolonged, covert access to compromised systems without triggering immediate alarms, which is the main benefit of this framework.
A combination of these features makes TeamFiltration a useful tool for long-term intrusion campaigns as it enhances an attacker's ability to keep persistence within targeted networks and to siphon sensitive data for extended periods of time. By analysing a series of distinctive digital fingerprints that were discovered during forensic analysis, Proofpoint was able to pinpoint both the TeamFiltration framework and the threat actor dubbed UNK_SneakyStrike as being responsible for this malicious activity.
As a result, there were numerous issues with the tool, including a rarely observed user agent string, hardcoded client identifications for OAuth, and a snapshot of the Secureworks FOCI project embedded within its backend architecture that had been around for quite some time. As a result of these technical artefacts, researchers were able to trace the attack's origin and misuse of tools with a high degree of confidence, enabling them to trace the campaign's origin and tool misuse with greater certainty.
An in-depth investigation of the attack revealed that the attackers were obfuscating and circumventing geo-based blocking mechanisms by using Amazon Web Services (AWS) infrastructure spanning multiple international regions in order to conceal their real location. A particularly stealthy manoeuvre was used by the threat actors when they interacted with the Microsoft Teams API using a "sacrificial" Microsoft Office 365 Business Basic account, which gave them the opportunity to conduct covert account enumeration activities.
Through this tactic, they were able to verify existing Entra ID accounts without triggering security alerts, thereby silently creating a map of user credentials that were available. As a result of the analysis of network telemetry, the majority of malicious traffic originated in the United States (42%). Additional significant activity was traced to Ireland (11%) and the United Kingdom (8%) as well. As a consequence of the global distribution of attack sources, attribution became even more complex and time-consuming, compromising the ability to respond efficiently.
A detailed advisory issued by Proofpoint, in response to the campaign, urged organisations, particularly those that rely on Microsoft Entra ID for cloud identity management and remote access-to initiate immediate mitigations or improvements to the system. As part of its recommendations, the TeamFiltration-specific user-agent strings should be flagged by detection rules, and multi-factor authentication (MFA) should be enforced uniformly across all user roles, based on all IP addresses that are listed in the published indicators of compromise (IOCs).
It is also recommended that organisations comply with OAuth 2.0 security standards and implement granular conditional access policies within Entra ID environments to limit potential exposure to hackers. There has been no official security bulletin issued by Microsoft concerning this specific threat, but internal reports have revealed that multiple instances of unauthorised access involving enterprise accounts have been reported. This incident serves as a reminder of the risks associated with dual-use red-teaming tools such as TeamFiltration, which can pose a serious risk to organisations.
There is no doubt in my mind that such frameworks are designed to provide legitimate security assessments, however, as they are made available to the general public, they continue to raise concerns as they make it more easy for threat actors to use them to gain an advantage, blurring the line between offensive research and actual attack vectors as threats evolve.
The attackers during the incident exploited the infrastructure of Amazon Web Services (AWS), but Amazon Web Services (AWS) reiterated its strong commitment to promoting responsible and lawful use of its cloud platform. As stated by Amazon Web Services, in order to use its resources lawfully and legally, all customers are required to adhere to all applicable laws and to adhere to the platform's terms of service.
A spokesperson for Amazon Web Services explained that the company maintains a clearly defined policy framework that prevents misappropriation of its infrastructure. As soon as a company receives credible reports that indicate a potential violation of these policies, it initiates an internal investigation and takes appropriate action, such as disabling access to content that is deemed to be violating the company's terms. As part of this commitment, Amazon Web Services actively supports and values the global community of security researchers.
Using the UNK_SneakyStrike codename, the campaign has been classified as a highly orchestrated and large-scale operation that is based on the enumeration of users and password spraying. According to researchers at Proofpoint, these attempts to gain access to cloud computing services usually take place in bursts that are intense and short-lived, resulting in a flood of credentials-based login requests to cloud environments. Then, there is a period of quietness lasting between four and five days after these attacks, which is an intentional way to prevent continuous detection and prolong the life cycle of the campaign while enabling threat actors to remain evasive.
A key concern with this operation is the precision with which it targets its targets, which makes it particularly concerning. In the opinion of Proofpoint, attackers are trying to gain access to nearly all user accounts within the small cloud tenants, while selectively targeting particular users within the larger enterprise environments.
TeamFiltration's built-in filtering capabilities, which allow attackers to prioritise the highest value accounts while avoiding detection by excessive probing, are a calculated approach that mirrors the built-in filtering capabilities of TeamFiltration. This situation underscores one of the major challenges the cybersecurity community faces today: tools like TeamFiltration that were designed to help defenders simulate real-world attacks are increasingly being turned against organisations, instead of helping them fight back.
By weaponizing these tools, threat actors can infiltrate cloud infrastructure, extract sensitive data, establish long-term access, and bypass conventional security controls, while infiltrating it, extracting sensitive data, and establishing long-term control. In this campaign, we are reminded that dual-purpose cybersecurity technologies, though essential for improving organization resilience, can also pose a persistent and evolving threat when misappropriated.
As the UNK_SneakyStrike campaign demonstrates, the modern threat landscape continues to grow in size and sophistication, which is why it is imperative that cloud security be taken into account in a proactive, intelligence-driven way. Cloud-native organisations must take steps to enhance their threat detection capabilities and go beyond just reactive measures by investing in continuous threat monitoring, behavioural analytics, and threat hunting capabilities tailored to match their environments' needs.
In the present day, security strategies must adapt to the dynamic nature of cloud infrastructure and the growing threat of identity-based attacks, which means relying on traditional perimeter defences or static access controls will no longer be sufficient. In order to maintain security, enterprise defenders need to routinely audit their identity and access management policies, verify that integrated third-party applications are secure, and review logs for anomalies indicative of low-and-slow intrusion patterns.
In order to build a resilient ecosystem that can withstand emerging threats, cloud service providers, vendors, and enterprise security teams need to work together in order to create a collaborative ecosystem. As an added note, cybersecurity community members must engage in ongoing discussions about how dual-purpose security tools should be distributed and governed to ensure that innovation intended to strengthen defences is not merely a weapon that compromises them, but rather a means of strengthening those defences.
The ability to deal with advanced threats requires agility, visibility, and collaboration in order for organisations to remain resilient. There is no doubt that organisations are more vulnerable to attacks than they were in the past, but they can minimise exposure, contain intrusions quickly, and ensure business continuity despite increasingly coordinated, deceptive attack campaigns if they are making use of holistic security hygiene and adopting a zero-trust architecture.
In the majority of cases, these fraudulent applications are accompanied by links to phishing websites that appear legitimate, but are really just a way to trick human resources professionals into downloading malware or disclosing sensitive login information unknowingly. FIN6 uses the trust inherent in the hiring process in order to penetrate enterprise networks through human resources departments, which is regarded as a relatively low-risk vector by cybersecurity frameworks due to their trustworthiness.
As soon as attackers gain access, they establish persistent backdoors that allow them to harvest credentials, gain access to unauthorised systems, and distribute ransomware or data exfiltration tools. In addition to highlighting the growing scope of social engineering threats, this campaign also exposes a critical omission in the cybersecurity sector, as threat actors exploit the urgency and volume of modern hiring practices as a way to bypass traditional technical defences in corporate security.
With the rise of e-mail, job portals, and resume sharing platforms, the attack surface for organisations is becoming increasingly broader as they digitise their recruitment workflows. In light of FIN6's latest tactic, it is evident that cybersecurity must extend beyond IT departments and into every aspect of corporate operations—including human resources—in order to remain compliant. This cybercriminal group, known as FIN6, has begun using sophisticated social engineering techniques in their attacks on corporate recruiters, posing as job applicants to recruiters in a sophisticated variation of traditional social engineering tactics.
Using persuasive resumes and embedded malicious links to phishing websites, the attackers aim to trick human resources personnel into installing malware under the guise of routine candidate screening, as the malware is disguised as a phishing website link.
In this strategic pivot, the organisation demonstrates its growing reliance on psychological manipulation versus brute force technical intrusions, which capitalises on the inherent trust embedded within recruitment communications to boost the organisation's reputation. FIN6—also referred to in threat intelligence circles as "Skeleton Spider"—first gained attention for its financially motivated attacks, notably the compromise of point-of-sale (PoS) systems to obtain credit card information.
It is estimated that the group, with its ever-evolving methods, has now expanded its operations to include ransomware attacks. The group collaborates with prominent ransomware strains like Ryuk and Locky to carry out this task. In its recent campaign, FIN6 has been observed to distribute a sophisticated malware-as-a-service (MaaS) tool known as More_eggs, a stealthy JavaScript-based backdoor known as More_eggs.
Upon being installed, this malware facilitates unauthorised credential harvesting, remote system access, as well as the dissemination of ransomware as a launchpad. In addition to its ability to blend seamlessly into legitimate Windows processes, More_eggs can evade many traditional endpoint detection systems, which makes it especially dangerous.
In the cyber threat landscape, this group's reliance on this payload highlights a wider trend that is taking place: the integration of social engineering with advanced malware delivery in order to circumvent layered security systems. It is widely known that FIN6 originated as a group that orchestrated large-scale breaches of retail point-of-sale (PoS) systems.
It has continuously adjusted its tactics since becoming known in 2014 as one of the most dangerous cyber threat groups. Having been doing a deceptive job scam for years, this group has reimagined the classic job scam by building trust with recruiters, not by targeting job seekers as it does with job seekers. This calculated approach has been used to create phishing messages that mention resume links in plain text, rather than hyperlinks that can be clicked on.
The recipient must manually enter the URLs into their browsers as a result of this, bypassing automated security filters that are designed to detect malicious links in emails. The domains that are used to advertise these campaigns are usually registered anonymously and constructed in a manner that mimics the names of job applicants, who are likely to be genuine or plausible. In spite of being hosted on Amazon Web Services' infrastructure, these sites resemble legitimate portfolios or resumes once accessed.
Behind this facade lies a complicated web of sophisticated evasion methods, including traffic filtering mechanisms that are able to differentiate between human users and automated security crawlers, such as sandboxes. In addition to assessing criteria such as the use of residential IP addresses and browser behaviour that is consistent with the Windows environment, these filters also determine whether a user has successfully completed CAPTCHA challenges. Those users who satisfy all of the requirements are presented with a ZIP archive disguised in the form of a portfolio of the job applicant.
In the archive is a malicious .lnk file that is crafted to look like a standard resume. When executed, the shortcut triggers the installation of More_eggs, a JavaScript backdoor associated with the cybercriminal Venom Spider. The stealthy malware allows attackers to access remote computer systems, enabling them to steal credentials, collect surveillance footage, and potentially deploy ransomware.
FIN6 showed tremendous technical proficiency in the execution of this attack, showcasing FIN6’s profound understanding of cyber defence mechanisms as well as human psychology in order to demonstrate that organisations must implement cybersecurity awareness into all aspects of business operations — including human resources — in order to remain competitive.
With the construction of its attack infrastructure, FIN6 has shown a high level of operational security and technical sophistication in the ongoing campaign. A series of domains have been registered by the group anonymously through GoDaddy, which were hosted on Amazon Web Services (AWS). This trusted cloud provider is rarely flagged by standard security solutions for security reasons.
Through using Amazon Web Services' reputation and global infrastructure, FIN6 can make its malicious portfolio sites look legitimate, while evading traditional detection mechanisms by using Amazon Web Services' reputation and global infrastructure. As part of the campaign, domain names are cleverly chosen to coincide with the fake personas created by the attackers, thereby lending credibility to their phishing activities.
Examples include: bobbyweisman[.]com, emersonkelly[.]com, davidlesnick[.]com, kimberlykamara[.]com, annalanyi[.]com, bobbybradley[.]net, malenebutler[.]com, lorinash[.]com, alanpower[.]net, and edwarddhall[.]com. This unique design of each domain is intended to resemble the website or portfolio of a legitimate job candidate, aligning with recruiters' expectations as they look for candidates.
The campaign is protected from discovery and analysis by FIN6's robust environmental fingerprinting and behavioral validation checks, which protect it from discovery and analysis. Typically, recruiters who access the site from their residential IP addresses on Windows systems are the only ones who are able to view the actual malicious content on the site.
When attempted access is made through virtual private networks (VPNs), cloud-hosted environments, or non-Windows platforms such as Linux and macOS, decoy content is served to the victim, effectively reducing the chances that cybersecurity researchers and automated security tools will see the malicious payload. Those who meet the attacker's criteria are also asked to complete a fake CAPTCHA challenge as an extra layer of social engineering on the landing page.
A ZIP archive presenting a resume is requested by the attacker once the page has been completed. In reality, the archive consists of a .lnk file that acts as a disguised Windows shortcut that launches the More_eggs malware upon execution. With the use of this JavaScript-based backdoor, threat actors can gain persistence, exfiltrate credentials, and possibly launch ransomware. FIN6’s strong understanding of digital trust signals is reflected in this campaign’s precise targeting and environmental filtering. This campaign has emerged as one of the most technically sophisticated phishing operations that has been seen over the past couple of years.
Organisations must adopt a multilayered security strategy that incorporates both technical defences as well as human vigilance to effectively mitigate the risk posed by targeted social engineering campaigns such as those orchestrated by FIN6. The fact that human resources professionals and recruiting teams are increasingly being targeted by cybercriminals makes it imperative that they be able to stay informed about cybersecurity.
The employees of the organisation who have regular contact with external emails and file attachments should receive comprehensive, role-specific security training. As part of this training, participants should learn to recognise phishing indicators, understand social engineering tactics, and understand the proper protocol for reporting suspicious activity, as well as understand the various types of phishing indicators.
Technically, organisations need to ensure that sandboxing solutions are implemented that allow potentially malicious attachments to be safely exploded and analysed before they can be accessed on production systems through sandboxing solutions. Taking this proactive step can prevent malware from being executed disguised as legitimate files in the future.
A system administrator should also think about disabling or restricting the execution of .LNK shortcut files unless they serve a clearly defined and necessary business function. In addition, phishing attacks frequently exploit these file types as they offer a direct path to executing embedded scripts without being aware of them.
There should be a strong policy implemented across departments that all downloaded files must be verified before they are opened, backed up by automated scanning tools whenever possible. In addition, it is important to invest in robust endpoint detection and response (EDR) systems. In these tools, the system behaviour is continuously monitored, anomalies are detected, and real-time action is taken to counter threats such as unauthorised downloads, lateral movement, or attempts to set up persistent backdoors are identified.
It has been demonstrated that organisations can significantly reduce their exposure to advanced, socially engineered attacks through the use of technical safeguards and targeted user education, which will help them safeguard their critical business functions from compromise and reduce their exposure to advanced, socially engineered attacks.
The sophistication of cyber threats, such as those deployed by FIN6, makes it imperative for organisations to take a strategic and forward-looking approach to protecting all business units, not just their IT infrastructure. Increasingly, cybercriminals are weaponising everyday workflows such as recruitment, requiring security to be embedded in the culture of all departments, particularly those seen as non-technical.
Developing a culture of cyber resilience requires more than just reactive defences; it demands that proactive risk assessments, threat modelling, and interdepartmental collaboration become an integral part of ensuring cyber resilience. For enterprises to ensure that their defences are future-proof, they need to invest in adaptive security architectures that incorporate behavioural analytics, threat intelligence, and zero-trust access controls.
Recruitment and human resources technologies need to be evaluated from a security-first perspective, ensuring third-party job boards, resume processing platforms, and applicant tracking systems are also rigorously vetted. In order to stay on top of the changing threat landscape, internal processes should constantly be updated to reflect the evolving threat landscape as well as vendor partnerships.
As the business world embraces the digital transformation of the enterprise, threat actors are also embracing the same. The FIN6 campaign provides a stark demonstration of how trust can be manipulated even in the most unexpected situations.
Those organisations that are aware of this shift and that respond by building resilience at both a technological and human level will have a much better chance at defending their data as well as their reputation, operations, and long-term stability in an era where every click is accompanied by the consequences it entails.