Hackers Spied on a Stock Exchange Executive's Outlook Mailbox for Five Months
Attackers stayed inside a stock exchange executive’s Outlook mailbox for at least five months, exporting mail in small batches through Dropbox and OneDrive.
Intelligence analysis by GPT-5.4 Mini
Symantec says the intrusion looked like espionage rather than theft for profit. The attackers used legitimate cloud services, scheduled tasks, and mailbox-export tooling to quietly collect an executive’s emails and related data without relying on a disclosed vulnerability.
Hackers got into a top manager’s email and quietly copied messages for months, like someone sneaking small pages out of a desk drawer every few weeks. They hid the copying inside normal cloud tools so it would look less suspicious.
Analysis
What happened
According to Symantec and Carbon Black’s Threat Hunter Team, unknown attackers spent at least five months inside the Outlook mailbox of a senior executive at a major global stock exchange. The operation appears designed for intelligence gathering: mail was copied out in small, repeated chunks and routed through Dropbox and OneDrive so it would blend with ordinary cloud traffic.
How the intrusion worked
The first malicious activity was seen on October 10, 2025. By then, the attacker was already running two binaries as SYSTEM, the highest Windows privilege level. One pretended to be an Adobe updater and the other mimicked OneDrive. Symantec said the initial foothold probably came from lateral movement from another compromised device, but the exact entry point remains unknown.
On November 12, the attacker escalated the operation by pulling a Dropbox API token, uploading data with curl, and deploying a mailbox-stealing tool built on Aspose, a legitimate .NET library that can read Outlook OST and PST files. The tool exported the mailbox to PST, used a password and a date-range flag, and on its first run grabbed everything from August 2025 onward. After that, it returned every two to four weeks and exported only the newest mail since the previous run. Eight more pulls followed through February 17, 2026.
Why this was hard to catch
The attacker leaned on normal-looking system tasks and consumer cloud services. Scheduled tasks were disguised as Adobe, Lenovo, and OneDrive services. For OneDrive exfiltration, the intruder used hard-coded Microsoft IP addresses instead of the usual hostname, which avoided DNS lookups that a perimeter tool might have noticed. A test upload to temp.sh happened once in November, then was abandoned.
The last observed event, on March 19, 2026, was a backdoor that was staged but never executed, which may indicate the attacker lost access soon after. Symantec’s indicators also suggest a broader intrusion kit was involved, including FRPC for tunneling, Secretsdump for credential extraction, SharpDecryptPwd for saved-password recovery, and a tool to bypass Windows User Account Control. The report does not tie the activity to a named group.
The central takeaway is that this was not a patched software flaw story. It was a mailbox compromise against a privileged user, which means the defensive burden falls on monitoring, response, and detection of behavior rather than waiting for a vendor fix.
Key points
- Attackers reportedly sat in a stock exchange executive’s Outlook mailbox for at least five months.
- Mail was exported in small batches and sent through Dropbox and OneDrive to hide in normal traffic.
- Symantec said the activity looked like espionage, not a direct financial theft attempt.
- The case did not involve a disclosed CVE, so patching alone would not have stopped it.
- The report points defenders toward mailbox-export activity, cloud exfiltration, and credential-dumping behavior.
If defenders catch this kind of activity early, they can limit the damage to a mailbox instead of broader business systems. The report also gives security teams concrete indicators and behaviors to hunt for, which can improve detection around privileged users and cloud-based exfiltration.
A months-long mailbox compromise can expose sensitive deal plans, regulatory matters, and executive contacts long before anyone notices. Because the operation used legitimate tools and cloud services instead of a new exploit, similar attacks can be hard to block with patching alone.
