Critical Outlook Vulnerability Exposes Stock Exchange Credentials

Key Takeaways

• A senior executive’s Microsoft Outlook account at a major global stock exchange was compromised for five months, from October 2025 to March 2026.
• Attackers systematically exfiltrated the executive’s entire mailbox contents in small, stealthy batches using legitimate cloud services like Dropbox and OneDrive to avoid detection.
• The campaign, attributed to espionage, utilized masquerading binaries and a legitimate .NET library (Aspose) to maintain persistence and convert Outlook data for exfiltration.
• The sophisticated operational discipline and use of common tools made attribution to a specific threat group impossible, highlighting the challenge of detecting advanced persistent threats.
• Defenders should focus on monitoring unusual scheduled tasks, bulk file transfers from mail directories, and restricting outbound cloud storage connections.

Stealthy Espionage Campaign Targets Stock Exchange Executive’s Outlook

A sophisticated and highly covert cyber espionage operation successfully compromised the Microsoft Outlook account of a senior executive at a prominent global stock exchange for an extended period of five months. The attackers meticulously siphoned off the executive’s email communications in a phased manner, a technique specifically engineered to bypass conventional security measures and remain undetected, according to a detailed report. The infiltration spanned from October 2025 to at least March 2026, with the sole objective of acquiring the complete contents of the executive’s mailbox without triggering any alarms.

This incident underscores the immense value of sensitive information residing within a high-ranking individual’s email account. The attackers’ deliberate targeting of a stock exchange executive’s inbox suggests a clear motivation beyond typical data theft. Such an email account can harbor critical intelligence, including forthcoming listings, regulatory actions, confidential internal discussions, calendar entries, and non-public market-moving information.

Uninterrupted access to this wealth of data over several months provides adversaries with an unparalleled understanding of the organization’s immediate strategic direction, all without needing to compromise any other network systems. Researchers from Symantec’s Threat Hunter Team, in collaboration with Carbon Black, uncovered this campaign. They noted that the attackers’ reliance on legitimate cloud infrastructure and readily available tools made it impossible to attribute the activity to any known threat group.

Symantec stated in a report provided to Cyber Security News (CSN) that the observed commands and objectives were consistent with an espionage motivation. The exceptional operational discipline displayed by the attackers was deemed significant enough to warrant public disclosure, a deviation from the team’s usual policy of not reporting on single-victim incidents.

A key factor contributing to the campaign’s stealth was the attackers’ seamless integration with normal network traffic. By exclusively using cloud services that are part of daily legitimate enterprise operations, their malicious activities were effectively camouflaged within routine network noise, thereby evading typical security alerts. Throughout the five-month period, the threat actors repeatedly re-established persistence on the compromised machine, continuously refining their techniques to maintain access.

Initial Infiltration and Data Collection

While the exact initial access vector remains unconfirmed, by October 2025, the attackers had already deployed two masquerading binaries on the victim’s system, both operating with SYSTEM-level privileges. One binary disguised itself as an Adobe update service, named armsvc.exe, while the other impersonated a Microsoft OneDrive component, identified as oneservice.exe. Both executables were configured to launch automatically via scheduled tasks, establishing a persistent foothold before the primary data exfiltration phase commenced.

The central tool for data theft leveraged Aspose, a legitimate .NET library designed for processing Outlook data files. Attackers utilized this library to convert the executive’s offline Outlook storage file (.OST) into a portable format, which was then discreetly transferred off the machine. This specialized tool was observed operating under three temporary filenames: ts_9ea0.tmp, ts_e0d5.tmp, and ts_e2d5.tmp, all sharing an identical file hash. The exfiltration process began with emails dating back to August 2025, with each subsequent extraction picking up precisely where the previous one concluded, gradually building a comprehensive copy of the entire mailbox contents.

Exfiltration Tactics via Cloud Services

The stolen data was funneled out of the network primarily through legitimate cloud services, specifically Dropbox and OneDrive. The attackers employed standard command-line tools for these transfers, ensuring their activity appeared innocuous within most enterprise environments. For Dropbox exfiltration, they consistently reused the same application credentials, only rotating short-lived authorization tokens to maintain access. When using OneDrive, the threat actors ingeniously circumvented DNS-based filtering by directing requests to hard-coded Microsoft IP addresses. This tactic prevented any suspicious domain lookups from appearing in perimeter logs, further enhancing their operational secrecy.

In late November 2025, the attackers briefly experimented with an alternative exfiltration route, uploading files to a public temporary file-hosting service, temp.sh. However, this method was abandoned after only a few attempts. The campaign demonstrated ongoing evolution, with a new DLL (te.host.dll) and another masquerading binary (armdriver.exe) deployed in March 2026, indicating the attackers were actively refining their methods up until the operation’s conclusion.

What You Should Do

• Monitor Scheduled Tasks: Implement robust monitoring for the creation of new scheduled tasks, especially those using names that mimic legitimate vendor services (e.g., Adobe, Microsoft).
• Detect Abnormal File Transfers: Configure alerts for bulk file transfers originating from email data directories (e.g., .PST or .OST files) or involving unusual file types being moved to cloud storage.
• Restrict Cloud Storage Access: Enforce strict outbound connection policies for cloud storage APIs, allowing access only from authorized applications and users, and consider granular access controls.
• Behavioral Analytics for Outlook Files: Deploy behavioral analytics tools that can flag unusual access patterns to Outlook storage files, such as repeated or large-scale reads by non-Outlook processes.
• Review DNS Logs: Regularly audit DNS logs for anomalies, but also recognize that sophisticated attackers may bypass DNS, necessitating network flow analysis for direct IP connections to cloud services.
• Implement Multi-Factor Authentication (MFA): Ensure MFA is enforced for all executive accounts and critical systems to mitigate the impact of stolen credentials.

Indicators of Compromise (IoCs)

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.