When Legitimate Security Tools Become Cyber Threats

A little less than two thousand years ago, Roman citizens were forced to watch as their mighty capital and empire came crashing to the ground at the hands of an unstoppable Visigoth army. Perhaps the worst part of the destruction, at least for Roman leaders, was facing the uncomfortable truth that these soldiers destroying their city were doing so with the very weapons, armor, and training that Rome had provided, under the pretense that those tools would be used to protect the empire.

In cybersecurity, we face the same uncomfortable situation almost daily. The powerful tools we create to defend, outwit, and protect against cybercriminals often become the very tools those cybercriminals use against us.

A recent report from Proofpoint highlights this growing danger: a threat group tracked as UNK_SneakyStrike has been leveraging an open-source penetration testing tool—TeamFiltration—for account takeover (ATO) campaigns across Microsoft Entra ID environments.

What’s Happening

TeamFiltration was initially released at DEFCON 2021 as a legitimate red teaming framework for Office 365/Azure environments. Since December 2024, however, attackers have increasingly weaponized it—using it for credential spraying, account enumeration, data exfiltration via OneDrive, and long-term persistence tactics. Ironically, it’s now being used against the very companies it was meant to help secure.

To date, more than 80,000 user accounts across 100+ cloud tenants have been targeted, with alarming success.

Why This Matters

Because TeamFiltration mimics legitimate admin traffic (like Microsoft Teams API calls), defenders may easily dismiss this malicious behavior as harmless red teaming or internal testing.

To make matters worse, attackers are leveraging globally distributed AWS infrastructure to rotate their attack sources, making these campaigns both stealthy and scalable. Once users authenticate via OneDrive or Teams OAuth, attackers can obtain family refresh tokens, a powerful persistence mechanism that is difficult to detect and even harder to revoke.

Where Do We Go From Here

The rise in misuse of legitimate tools means defenders must become more attentive and adaptive than ever before. Key priorities include:

·         Monitor subtle signs of abuse, such as suspicious user agent strings or impossible travel logins, even when traffic appears normal.

·         Go beyond static allowlists. Behavioral analytics are crucial for identifying anomalies, such as inconsistent device IDs or cross-region access patterns.

·         Reinforce zero trust principles. Shorten token lifetimes, tighten session controls, and implement robust conditional access policies for OAuth flows.

Final Thoughts

The need for stronger tools to defend our systems will never go away. We can’t stop developing them just because attackers might copy us. But as cybersecurity professionals, we must be constantly aware of how the tools we create could be turned against us and plan accordingly.

When adversaries wield our own instruments, defense becomes more complex. It’s no longer about blocking the bad apps. It’s about understanding how legitimate tools are being illegitimately used and adapting accordingly.

Otherwise, like the ancient Romans, we may find our capitals burning beneath the very defenses we thought would save them.