Espionage Campaign Targeted Stock Exchange Executive for Five Months

A five-month espionage campaign targeted the Outlook mailbox of a senior executive at a major global stock exchange, using masqueraded binaries and legitimate cloud services for persistence and data exfiltration. The attackers achieved SYSTEM-level access and deployed a custom Aspose-based OST stealer to incrementally extract mailbox data, exfiltrating it in small batches via Dropbox and OneDrive Personal to avoid detection. The campaign demonstrated high operational discipline, leveraging scheduled tasks, IP-based OneDrive connections to evade DNS logging, and multiple file redeployments under different names but consistent hashes, indicating a focused, long-term intelligence collection effort.

AI-extracted · verify before operational use