Stock Exchange Executive Mailbox Espionage — Five-Month Intrusion via Masquerading SYSTEM Binaries (armsvc.exe / oneservice.exe), Aspose-Based OST Theft, and Dropbox/OneDrive C2 & Exfiltration
Stock Exchange Executive Mailbox Espionage (TL-2026-0672), also tracked as Stock Exchange Executive Mailbox Espionage, is a high-severity advanced persistent threat campaign, first published 2026-06-03. It has no confirmed attribution, affects Microsoft Windows (endpoint with privileged/executive Outlook profile), maps to 21 MITRE ATT&CK techniques (T1003, T1005, T1030), and is covered by 9 detection rules and 46 indicators of compromise.
Key facts for TL-2026-0672
- Threat ID
- TL-2026-0672
- Also known as
- Stock Exchange Executive Mailbox Espionage
- Severity
- HIGH
- Status
- ACTIVE
- Category
- APT
- First published
- 2026-06-03
- Last reviewed
- 2026-06-03
- Attribution confidence
- NONE
- Motivation
- ESPIONAGE
- Target sectors
- financial, financial-markets, stock-exchange, critical-infrastructure
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 46
Malware and tooling in Stock Exchange Executive Mailbox Espionage
Malware and tooling: Aspose, FRPC, Secretsdump, SharpDecryptPwd
Symantec/Broadcom documented a disciplined, five-month espionage intrusion that stole the Outlook mailbox of a senior executive at a major global stock exchange, exfiltrating it in incremental date-bounded batches via Dropbox and OneDrive Personal to blend with legitimate cloud traffic. The attackers ran masquerading binaries as SYSTEM (armsvc.exe posing as the Adobe Acrobat update service, oneservice.exe as a OneDrive helper), used the commercial Aspose .NET library to carve OST data by date range, and maintained persistence through frequent scheduled tasks named after Adobe, Lenovo, and OneDrive. The activity is unattributed.
How Stock Exchange Executive Mailbox Espionage works
Symantec's Threat Hunter Team disclosed a long-running, operationally disciplined espionage operation that compromised the host of a senior executive at a major global stock exchange and exfiltrated the executive's Outlook mailbox over roughly five months. The objective was pure intelligence collection — the executive's external negotiations, internal deliberations, calendar, travel patterns, and contacts — the kind of non-public, market-moving information an exchange holds about listings, enforcement actions, and corporate events. No ransomware, destruction, or lateral movement was needed; sustained mailbox access alone satisfied the objective.
When Symantec first observed activity on 10 October 2025, the attackers already held SYSTEM-level access: two masquerading binaries — armsvc.exe (path CSIDL_COMMON_APPDATA\adobe\arm\armsvc.exe, posing as the legitimate Adobe Acrobat Reader update service) and oneservice.exe (path CSIDL_PROFILE\appdata\local\microsoft\onedrive\setup\oneservice.exe, posing as a OneDrive setup helper) — were running as SYSTEM, each spawned by wininit.exe under the Service Control Manager. Local privilege escalation had therefore been achieved before the first observed activity (UAC bypass tooling, bypassuac.exe, was later seen on the host). Persistence was reinforced with high-frequency scheduled tasks masquerading as vendor maintenance jobs: an Adobe 'ARM Service' task firing every five minutes, OneDrive sync tasks every three minutes, and Lenovo 'CheckServerHealth' tasks at varying multi-hour intervals (300/900/1440 minutes) that launched batch files (c:\windows emp\1.bat through 5.bat) and redirected output to matching .txt files.
The campaign entered its active phase on 12 November 2025 with an OAuth handshake that obtained a Dropbox API token, followed by the first Outlook OST extraction. The attackers used Aspose — a legitimate commercial .NET library for parsing Outlook OST/PST files — invoked as c:\windows emp\Aspose.exe with a password (-p), the target OST (-f), an output directory (-o), and crucially a date-range flag (-t) such as 20250819-20251112. Subsequent runs narrowed the windows (20251112-20251121, 20251120-20251209, 20251209-20251216, and so on) at roughly two-to-four-week intervals through the final extraction on 17 February 2026, deliberately chunking the mailbox into small batches to stay under data-transfer and detection thresholds.
Command-and-control and exfiltration were built entirely on trusted public cloud services. A single persistent Dropbox application (constant client_id/client_secret, rotating per-session authorization codes) received uploads via curl POST to content.dropboxapi.com/2/files/upload with a Bearer token obtained from api.dropbox.com/oauth2/token. From 20-21 November the attackers added a OneDrive Personal channel (onedrive.live.com/personal/... _api AddUsingPath uploads) and briefly experimented with the public file-host temp.sh (51.91.79.17:443). To suppress telltale DNS lookups, the OneDrive channel was later switched to hard-coded Microsoft IP addresses 13.107.137.11 and 150.171.41.11. BeaconBeagle returned no matches for any network indicator — consistent with deliberate living-off-trusted-cloud tradecraft that leaves no dedicated C2 infrastructure to fingerprint.
Late in the campaign the attackers refreshed their toolset and persistence anchors: onedrivesync.exe (CSIDL_COMMON_APPDATA\microsoft onedrive\setup\onedrivesync.exe) was added as a persistence binary on 27 February 2026, and a previously unseen armdriver.exe (CSIDL_COMMON_APPDATA\adobe\arm\ondemand\armdriver.exe) plus te.host.dll (installed in CSIDL_COMMON_APPDATA\intel) appeared on 19 March 2026, the date of final observed activity. The mailbox-stealer payload itself was redeployed under rotating temp names (ts_9ea0.tmp, ts_e0d5.tmp, ts_e2d5.tmp — all sharing one SHA256) from CSIDL_WINDOWS emp and nested skin/licenses subfolders. Public/offensive tooling observed on the host included curl.exe, SharpDecryptPwd (credential decryption), Secretsdump (Impacket credential dumping), FRPC (fast reverse proxy for tunneling), and UAC-bypass utilities. The exclusive reliance on public tools and legitimate cloud infrastructure left few identity clues, and Symantec did not attribute the activity to a known group, though the targeting and command patterns clearly indicate espionage motivation.
For defenders this intrusion is high-value detection-engineering material: concrete host artifacts (specific masquerading binary names and full paths, SYSTEM services spawned by wininit.exe, named high-frequency scheduled tasks impersonating Adobe/Lenovo/OneDrive), a distinctive Aspose OST-carving command line with date-range flags, and trusted-cloud C2/exfil patterns (Dropbox OAuth + upload, OneDrive AddUsingPath, hard-coded Microsoft IPs in curl to evade DNS) that demand behavioral rather than infrastructure-based detection.
MITRE ATT&CK techniques used in TL-2026-0672
Credential Access
T1003 OS Credential Dumping; T1555 Credentials from Password Stores
Collection
T1005 Data from Local System; T1074 Data Staged; T1114 Email Collection; T1560 Archive Collected Data
Exfiltration
T1030 Data Transfer Size Limits; T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
Defense Evasion
Execution
T1053 Scheduled Task/Job; T1059 Command and Scripting Interpreter
Command and Control
T1071 Application Layer Protocol; T1102 Web Service; T1105 Ingress Tool Transfer; T1572 Protocol Tunneling
Discovery
T1083 File and Directory Discovery
Persistence
T1543 Create or Modify System Process
Privilege Escalation
T1548 Abuse Elevation Control Mechanism
Resource Development
defense-impairment
Affected products and versions in Stock Exchange Executive Mailbox Espionage
- Microsoft — Windows (endpoint with privileged/executive Outlook profile)
Vulnerable versions: Windows (SYSTEM-level compromise; no specific version-bound vulnerability) - Microsoft — Outlook (OST offline data store)
Vulnerable versions: Any (OST harvested offline via third-party Aspose library)
Remediation for Stock Exchange Executive Mailbox Espionage
Immediate actions
- Hunt for scheduled tasks under \Microsoft\Windows\Adobe\ARM Service, \Microsoft\Windows\Lenovo\CheckServerHealth, and \Microsoft\Windows\MicrosoftOneDriveSyncServiceCore running as SYSTEM at sub-hourly intervals (/mo 3, /mo 5).
- Block/alert on the provided SHA256 hashes across EDR; isolate any host where they are found.
- Inspect CSIDL_COMMON_APPDATA\adobe\arm, ...\microsoft onedrive\setup, and CSIDL_COMMON_APPDATA\intel for armsvc.exe, armdriver.exe, onedrivesync.exe, oneservice.exe, te.host.dll that do not carry valid vendor signatures.
- Search for Aspose.exe (or any process) accessing *.ost with a -t date-range argument and writing to c:\windows\temp.
- Alert on curl.exe contacting api.dropbox.com, content.dropboxapi.com, onedrive.live.com, temp.sh, or hard-coded IPs 13.107.137.11 / 150.171.41.11 / 51.91.79.17.
Workarounds
- Restrict outbound access to personal cloud-storage services from servers and privileged workstations.
- Require code-signing validation for any binary installed under Adobe/OneDrive/Intel program-data paths.
Longer-term hardening
- Deploy EDR with behavioral detection for masquerading services spawned by wininit.exe and for SYSTEM-context curl usage.
- Apply egress controls / CASB policy to corporate-unsanctioned Dropbox and OneDrive Personal endpoints; alert on OAuth token exchanges from servers.
- Enforce DNS-based egress monitoring and alert on direct-to-IP HTTPS to Microsoft/cloud ranges that bypass normal name resolution.
- Privileged-mailbox monitoring: detect bulk/programmatic OST access and large incremental outbound transfers from executive endpoints.
- Application allow-listing to block unsigned binaries in user/common AppData paths.
Timeline of Stock Exchange Executive Mailbox Espionage
- First malicious activity observed by Symantec: armsvc.exe and oneservice.exe already running as SYSTEM (spawned by wininit.exe under the SCM). Privilege escalation had already occurred prior to this date.
- Campaign entered active phase: OAuth handshake to obtain a Dropbox API token, followed by the first Outlook OST extraction (date range from August 2025 onward, -t 20250819-20251112).
- OneDrive Personal added as a second exfiltration/C2 channel (onedrive.live.com _api AddUsingPath uploads).
- Brief experimental use of the public file-hosting service temp.sh (51.91.79.17:443) via curl -F upload.
- Continued incremental OST carving with narrowed date ranges (e.g., -t 20251120-20251209, -t 20251209-20251216) at two-to-four-week intervals; OneDrive later switched to hard-coded Microsoft IPs 13.107.137.11 / 150.171.41.11 to avoid DNS queries.
- Final OST extraction run in the series of two-to-four-week incremental exfiltration batches.
- Additional persistence anchor added via onedrivesync.exe (CSIDL_COMMON_APPDATA\microsoft onedrive\setup\onedrivesync.exe) with a 3-minute scheduled task.
- Deployment of previously unseen armdriver.exe (CSIDL_COMMON_APPDATA\adobe\arm\ondemand\armdriver.exe) and te.host.dll (CSIDL_COMMON_APPDATA\intel); final observed activity.
- Symantec/Broadcom Threat Hunter Team publicly disclosed the five-month campaign; activity left unattributed due to exclusive use of public tools and legitimate cloud infrastructure.
Sources cited for Stock Exchange Executive Mailbox Espionage
- Espionage Campaign Targeted Stock Exchange Executive for Five Months
- Global Stock Exchange Hit by Monthslong Email Campaign
- MITRE ATT&CK — T1567.002 Exfiltration to Cloud Storage
- MITRE ATT&CK — T1036.005 Masquerading: Match Legitimate Name or Location
- MITRE ATT&CK — T1053.005 Scheduled Task
- Aspose.Email for .NET (legitimate OST/PST parsing library abused in campaign)
Threats related to Stock Exchange Executive Mailbox Espionage
Detection coverage for TL-2026-0672
As of 2026-06-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0672 across Splunk SPL, Microsoft KQL and Sigma, covering 46 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.