Adversary Intelligence — 2026-06-04

Hackers Maintain 150-Day Access to Senior Executive Email at Global Stock Exchange in Espionage Operation

BLUFFive months of undetected access to a senior exchange executive's mailbox gave an operationally disciplined, likely state-backed actor a continuous feed of market-moving and regulatory intelligence.

Broadcom's Symantec and Carbon Black reported this week that an unattributed actor maintained roughly 150 days of access to a senior executive's Outlook mailbox at an unnamed global stock exchange, from October 2025 through March 2026 1234. The initial access vector is unknown; by October 10, two masquerading binaries disguised as Adobe and OneDrive processes were already running with SYSTEM privileges 123. On November 12 the attacker established Dropbox C2 and deployed an Aspose-based OST stealer that extracted the mailbox in incremental date-windowed archives every two to four weeks through February 17, 2026 23. Exfiltration ran through Dropbox and OneDrive Personal; the attacker hardcoded Microsoft IP addresses in place of hostnames for OneDrive calls to suppress DNS queries, and Symantec and Carbon Black declined to attribute the campaign to any known group 123.

Analysis
Five months of patient collection against a senior exchange executive's mailbox reflects operational discipline calibrated for sustained take. Dropbox C2, date-windowed OST extractions every two to four weeks, and hardcoded Microsoft IP addresses substituting for hostnames to suppress OneDrive DNS queries all point to an actor prioritizing deniability over speed. Target selection at a major financial exchange points to market-moving information, enforcement actions, and internal negotiations as the collection targets, intelligence products equally consistent with state-directed economic collection and a sophisticated corporate espionage-for-hire operation. Broadcom is the sole technical source; wide secondary coverage adds no independent depth. Financial institutions and regulators holding comparable non-public data constitute the implied wider exposure.

4 sources

Hackers Target Global Stock Exchange in Espionage Operation - SecurityWeek
Espionage Campaign Targeted Stock Exchange Executive for Five Months - Broadcom Security (Symantec/Carbon Black)
Cyber espionage campaign targeted stock exchange executive's Outlook account - Security Affairs
Global Stock Exchange Hit by Monthslong Email Campaign - Dark Reading