Stock Exchange Executive Mailbox Espionage — Five-Month Intrusion via Masquerading SYSTEM Binaries (armsvc.exe / oneservice.exe), Aspose-Based OST Theft, and Dropbox/OneDrive C2 & Exfiltration

Key facts for Aspose-based stock exchange OST theft

Detection coverage for Aspose-based stock exchange OST theft

As of 2026-06-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0672 across Splunk SPL, Microsoft KQL and Sigma, covering 46 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: curl Exfiltration to Cloud Storage or Hard-Coded Microsoft IP (Splunk / SPL) - C2 / Exfiltration Phase

Detects the trusted-cloud C2 and exfiltration channel of TL-2026-0672: curl.exe performing the Dropbox OAuth token exchange (api.dropbox.com/oauth2/token), chunked uploads (content.dropboxapi.com/2/files/upload), OneDrive Personal AddUsingPath uploads (onedrive.live.com), brief temp.sh (51.91.79.17) use, or direct-to-IP HTTPS to hard-coded Microsoft OneDrive addresses (13.107.137.11 / 150.171.41.11) that deliberately bypass DNS resolution to suppress telltale lookups.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1071.001, T1102.002, T1567.002, T1041, T1030, T1105
• Data sources: sysmon, microsoft_defender_endpoint, zeek_proxy
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 Image="*\\curl.exe"
`comment("TL-2026-0672 C2/exfil: curl to Dropbox/OneDrive cloud storage or hard-coded Microsoft IPs that bypass DNS")`
| search (CommandLine="*api.dropbox.com/oauth2/token*" OR CommandLine="*content.dropboxapi.com/2/files/upload*" OR CommandLine="*onedrive.live.com*" OR CommandLine="*_api/AddUsingPath*" OR CommandLine="*13.107.137.11*" OR CommandLine="*150.171.41.11*" OR CommandLine="*51.91.79.17*" OR CommandLine="*temp.sh*")
| eval channel=case(like(CommandLine,"%dropbox%"),"dropbox", (like(CommandLine,"%onedrive.live.com%") OR like(CommandLine,"%AddUsingPath%")),"onedrive_personal", (like(CommandLine,"%13.107.137.11%") OR like(CommandLine,"%150.171.41.11%")),"onedrive_hardcoded_ip_dns_evasion", (like(CommandLine,"%51.91.79.17%") OR like(CommandLine,"%temp.sh%")),"temp_sh", true(),"other")
| eval system_context=if(like(User,"%SYSTEM%"),"yes","no")
| table _time, host, User, ParentImage, Image, CommandLine, channel, system_context
| sort - _time

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
// TL-2026-0672 C2/exfil: curl to cloud-storage endpoints or hard-coded Microsoft IPs (DNS evasion)
| where FileName =~ "curl.exe"
| where ProcessCommandLine has_any ("api.dropbox.com/oauth2/token","content.dropboxapi.com/2/files/upload","onedrive.live.com","_api/AddUsingPath","13.107.137.11","150.171.41.11","51.91.79.17","temp.sh")
| extend Channel = case(
    ProcessCommandLine has "dropbox", "dropbox",
    ProcessCommandLine has "onedrive.live.com" or ProcessCommandLine has "AddUsingPath", "onedrive_personal",
    ProcessCommandLine has "13.107.137.11" or ProcessCommandLine has "150.171.41.11", "onedrive_hardcoded_ip_dns_evasion",
    ProcessCommandLine has "51.91.79.17" or ProcessCommandLine has "temp.sh", "temp_sh",
    "other")
| extend SystemContext = iff(InitiatingProcessAccountName =~ "system", "yes", "no")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, Channel, SystemContext

Sigma

title: curl Exfiltration to Cloud Storage or Hard-Coded Microsoft IP
id: 24e58241-3411-475e-ac17-cb7a55a96f8d
status: experimental
description: Detects the TL-2026-0672 trusted-cloud C2/exfiltration pattern - curl.exe contacting the Dropbox OAuth/upload APIs, OneDrive Personal AddUsingPath, the temp.sh file host, or hard-coded Microsoft OneDrive IPs (13.107.137.11 / 150.171.41.11) used to evade DNS-based egress monitoring.
references:
    - https://www.security.com/threat-intelligence/stock-exchange-espionage
    - https://attack.mitre.org/techniques/T1567/002/
    - https://attack.mitre.org/techniques/T1071/001/
author: AII-Detector - ThreadLinqs Intelligence
date: 2026/06/03
tags:
    - attack.command_and_control
    - attack.exfiltration
    - attack.t1071.001
    - attack.t1102.002
    - attack.t1567.002
    - attack.t1041
    - attack.t1030
logsource:
    product: windows
    category: process_creation
detection:
    selection_img:
        Image|endswith: '\curl.exe'
    selection_dst:
        CommandLine|contains:
            - 'api.dropbox.com/oauth2/token'
            - 'content.dropboxapi.com/2/files/upload'
            - 'onedrive.live.com'
            - '_api/AddUsingPath'
            - '13.107.137.11'
            - '150.171.41.11'
            - '51.91.79.17'
            - 'temp.sh'
    condition: selection_img and selection_dst
falsepositives:
    - Sanctioned corporate automation that legitimately uses curl with Dropbox/OneDrive Business APIs (personal-tenant endpoints and direct-to-IP calls remain suspicious)
level: high

Known false positives:

• Sanctioned corporate automation that legitimately uses curl with Dropbox/OneDrive Business APIs
• Software updaters or telemetry agents that fetch from Microsoft IP ranges (personal-tenant endpoints and direct-to-IP calls remain suspicious)

Tuning notes: Direct-to-IP HTTPS to 13.107.137.11 / 150.171.41.11 with no preceding DNS query, and any curl to onedrive.live.com personal-tenant or temp.sh, are the strongest signals - prioritize them over the broad domain matches. Escalate sharply when the parent/initiating account is SYSTEM. For network-telemetry coverage, mirror this against DeviceNetworkEvents / proxy logs (RemoteUrl or RemoteIP) and correlate with the Phase 2 Aspose carving and ts_*.tmp staging on the same host.

• 🔒 Vendor-Masquerading SYSTEM Foothold (wininit-Spawned Service / High-Frequency Scheduled Task) (Microsoft Defender / KQL) - Exploitation Phase · unlock with TL Creds
• 🔒 Aspose-Style Outlook OST Date-Range Carving (Microsoft Defender / KQL) - Post-Exploitation / Collection Phase · unlock with TL Creds
• 🔒 curl Exfiltration to Cloud Storage or Hard-Coded Microsoft IP (Microsoft Defender / KQL) - C2 / Exfiltration Phase · unlock with TL Creds
• 🔒 Vendor-Masquerading SYSTEM Foothold (wininit-Spawned Service / High-Frequency Scheduled Task) (Sigma) - Exploitation Phase · unlock with TL Creds
• 🔒 Aspose-Style Outlook OST Date-Range Carving (Sigma) - Post-Exploitation / Collection Phase · unlock with TL Creds
• 🔒 curl Exfiltration to Cloud Storage or Hard-Coded Microsoft IP (Sigma) - C2 / Exfiltration Phase · unlock with TL Creds
• 🔒 Vendor-Masquerading SYSTEM Foothold (wininit-Spawned Service / High-Frequency Scheduled Task) (Splunk / SPL) - Exploitation Phase · unlock with TL Creds
• 🔒 Aspose-Style Outlook OST Date-Range Carving (Splunk / SPL) - Post-Exploitation / Collection Phase · unlock with TL Creds

Indicators of compromise for Aspose-based stock exchange OST theft

As of 2026-06-03, Threadlinqs Intelligence tracks 46 indicators of compromise for TL-2026-0672.

Sample indicators (3 of 46)

• IP address: 51.91.79[.]17
• Domain: api[.]dropbox[.]com
• File hash: db59813e3f27fb8608a4876e758f60b69d9700dc22d15237ac095bb3166fb622

Defanged, TLP:CLEAR. Full set of 46 indicators: unlock with TL Creds.

How Aspose-based stock exchange OST theft works

The attackers ran masquerading binaries as SYSTEM (armsvc.exe posing as the Adobe Acrobat update service, oneservice.exe as a OneDrive helper), used the commercial Aspose .NET library to carve OST data by date range, and maintained persistence through frequent scheduled tasks named after Adobe, Lenovo, and OneDrive. The activity is unattributed.

Symantec's Threat Hunter Team disclosed a long-running, operationally disciplined espionage operation that compromised the host of a senior executive at a major global stock exchange and exfiltrated the executive's Outlook mailbox over roughly five months. The objective was pure intelligence collection — the executive's external negotiations, internal deliberations, calendar, travel patterns, and contacts — the kind of non-public, market-moving information an exchange holds about listings, enforcement actions, and corporate events. No ransomware, destruction, or lateral movement was needed; sustained mailbox access alone satisfied the objective.

When Symantec first observed activity on 10 October 2025, the attackers already held SYSTEM-level access: two masquerading binaries — armsvc.exe (path CSIDL_COMMON_APPDATA\adobe\arm\armsvc.exe, posing as the legitimate Adobe Acrobat Reader update service) and oneservice.exe (path CSIDL_PROFILE\appdata\local\microsoft\onedrive\setup\oneservice.exe, posing as a OneDrive setup helper) — were running as SYSTEM, each spawned by wininit.exe under the Service Control Manager. Local privilege escalation had therefore been achieved before the first observed activity (UAC bypass tooling, bypassuac.exe, was later seen on the host). Persistence was reinforced with high-frequency scheduled tasks masquerading as vendor maintenance jobs: an Adobe 'ARM Service' task firing every five minutes, OneDrive sync tasks every three minutes, and Lenovo 'CheckServerHealth' tasks at varying multi-hour intervals (300/900/1440 minutes) that launched batch files (c:\windows\temp\1.bat through 5.bat) and redirected output to matching .txt files.

The campaign entered its active phase on 12 November 2025 with an OAuth handshake that obtained a Dropbox API token, followed by the first Outlook OST extraction. The attackers used Aspose — a legitimate commercial .NET library for parsing Outlook OST/PST files — invoked as c:\windows\temp\Aspose.exe with a password (-p), the target OST (-f), an output directory (-o), and crucially a date-range flag (-t) such as 20250819-20251112. Subsequent runs narrowed the windows (20251112-20251121, 20251120-20251209, 20251209-20251216, and so on) at roughly two-to-four-week intervals through the final extraction on 17 February 2026, deliberately chunking the mailbox into small batches to stay under data-transfer and detection thresholds.

Command-and-control and exfiltration were built entirely on trusted public cloud services. A single persistent Dropbox application (constant client_id/client_secret, rotating per-session authorization codes) received uploads via curl POST to content.dropboxapi.com/2/files/upload with a Bearer token obtained from api.dropbox.com/oauth2/token. From 20-21 November the attackers added a OneDrive Personal channel (onedrive.live.com/personal/... _api AddUsingPath uploads) and briefly experimented with the public file-host temp.sh (51.91.79.17:443). To suppress telltale DNS lookups, the OneDrive channel was later switched to hard-coded Microsoft IP addresses 13.107.137.11 and 150.171.41.11. BeaconBeagle returned no matches for any network indicator — consistent with deliberate living-off-trusted-cloud tradecraft that leaves no dedicated C2 infrastructure to fingerprint.

Late in the campaign the attackers refreshed their toolset and persistence anchors: onedrivesync.exe (CSIDL_COMMON_APPDATA\microsoft onedrive\setup\onedrivesync.exe) was added as a persistence binary on 27 February 2026, and a previously unseen armdriver.exe (CSIDL_COMMON_APPDATA\adobe\arm\ondemand\armdriver.exe) plus te.host.dll (installed in CSIDL_COMMON_APPDATA\intel) appeared on 19 March 2026, the date of final observed activity. The mailbox-stealer payload itself was redeployed under rotating temp names (ts_9ea0.tmp, ts_e0d5.tmp, ts_e2d5.tmp — all sharing one SHA256) from CSIDL_WINDOWS\temp and nested skin/licenses subfolders. Public/offensive tooling observed on the host included curl.exe, SharpDecryptPwd (credential decryption), Secretsdump (Impacket credential dumping), FRPC (fast reverse proxy for tunneling), and UAC-bypass utilities. The exclusive reliance on public tools and legitimate cloud infrastructure left few identity clues, and Symantec did not attribute the activity to a known group, though the targeting and command patterns clearly indicate espionage motivation.

For defenders this intrusion is high-value detection-engineering material: concrete host artifacts (specific masquerading binary names and full paths, SYSTEM services spawned by wininit.exe, named high-frequency scheduled tasks impersonating Adobe/Lenovo/OneDrive), a distinctive Aspose OST-carving command line with date-range flags, and trusted-cloud C2/exfil patterns (Dropbox OAuth + upload, OneDrive AddUsingPath, hard-coded Microsoft IPs in curl to evade DNS) that demand behavioral rather than infrastructure-based detection.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003 OS Credential Dumping; T1555 Credentials from Password Stores

Collection

T1005 Data from Local System; T1074 Data Staged; T1114 Email Collection; T1560 Archive Collected Data

Exfiltration

T1030 Data Transfer Size Limits; T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service

Defense Evasion

T1036 Masquerading

Execution

T1053 Scheduled Task/Job; T1059 Command and Scripting Interpreter

Command and Control

T1071 Application Layer Protocol; T1102 Web Service; T1105 Ingress Tool Transfer; T1572 Protocol Tunneling

Discovery

T1083 File and Directory Discovery

Persistence

T1543 Create or Modify System Process

Privilege Escalation

T1548 Abuse Elevation Control Mechanism

Resource Development

T1583 Acquire Infrastructure

defense-impairment

T1685 Disable or Modify Tools

Remediation for Aspose-based stock exchange OST theft

Immediate actions

• Hunt for scheduled tasks under \Microsoft\Windows\Adobe\ARM Service, \Microsoft\Windows\Lenovo\CheckServerHealth, and \Microsoft\Windows\MicrosoftOneDriveSyncServiceCore running as SYSTEM at sub-hourly intervals (/mo 3, /mo 5).
• Block/alert on the provided SHA256 hashes across EDR; isolate any host where they are found.
• Inspect CSIDL_COMMON_APPDATA\adobe\arm, ...\microsoft onedrive\setup, and CSIDL_COMMON_APPDATA\intel for armsvc.exe, armdriver.exe, onedrivesync.exe, oneservice.exe, te.host.dll that do not carry valid vendor signatures.
• Search for Aspose.exe (or any process) accessing *.ost with a -t date-range argument and writing to c:\windows\temp.
• Alert on curl.exe contacting api.dropbox.com, content.dropboxapi.com, onedrive.live.com, temp.sh, or hard-coded IPs 13.107.137.11 / 150.171.41.11 / 51.91.79.17.

Workarounds

• Restrict outbound access to personal cloud-storage services from servers and privileged workstations.
• Require code-signing validation for any binary installed under Adobe/OneDrive/Intel program-data paths.

Longer-term hardening

• Deploy EDR with behavioral detection for masquerading services spawned by wininit.exe and for SYSTEM-context curl usage.
• Apply egress controls / CASB policy to corporate-unsanctioned Dropbox and OneDrive Personal endpoints; alert on OAuth token exchanges from servers.
• Enforce DNS-based egress monitoring and alert on direct-to-IP HTTPS to Microsoft/cloud ranges that bypass normal name resolution.
• Privileged-mailbox monitoring: detect bulk/programmatic OST access and large incremental outbound transfers from executive endpoints.
• Application allow-listing to block unsigned binaries in user/common AppData paths.

Affected and fixed versions

• Microsoft — Windows (endpoint with privileged/executive Outlook profile)
  Vulnerable versions: Windows (SYSTEM-level compromise; no specific version-bound vulnerability)
• Microsoft — Outlook (OST offline data store)
  Vulnerable versions: Any (OST harvested offline via third-party Aspose library)

Timeline of Aspose-based stock exchange OST theft

• 2025-10-10 First malicious activity observed by Symantec: armsvc.exe and oneservice.exe already running as SYSTEM (spawned by wininit.exe under the SCM). Privilege escalation had already occurred prior to this date.
• 2025-11-12 Campaign entered active phase: OAuth handshake to obtain a Dropbox API token, followed by the first Outlook OST extraction (date range from August 2025 onward, -t 20250819-20251112).
• 2025-11-20 OneDrive Personal added as a second exfiltration/C2 channel (locked-ioc-36 _api AddUsingPath uploads).
• 2025-11-21 Brief experimental use of the public file-hosting service locked-ioc-44 (locked-ioc-41:443) via curl -F upload.
• 2025-12-09 Continued incremental OST carving with narrowed date ranges (e.g., -t 20251120-20251209, -t 20251209-20251216) at two-to-four-week intervals; OneDrive later switched to hard-coded Microsoft IPs locked-ioc-39 / locked-ioc-40 to avoid DNS queries.
• 2026-02-17 Final OST extraction run in the series of two-to-four-week incremental exfiltration batches.
• 2026-02-27 Additional persistence anchor added via onedrivesync.exe (locked-ioc-28) with a 3-minute scheduled task.
• 2026-03-19 Deployment of previously unseen armdriver.exe (locked-ioc-29) and te.host.dll (locked-ioc-34); final observed activity.
• 2026-06-03 Symantec/Broadcom Threat Hunter Team publicly disclosed the five-month campaign; activity left unattributed due to exclusive use of public tools and legitimate cloud infrastructure.

Sources cited for Aspose-based stock exchange OST theft

• Espionage Campaign Targeted Stock Exchange Executive for Five Months security.com · Vendor report · 2026-06-03
• MITRE ATT&CK — T1567.002 Exfiltration to Cloud Storage MITRE · Research · 2026-06-03
• MITRE ATT&CK — T1036.005 Masquerading: Match Legitimate Name or Location MITRE · Research · 2026-06-03
• MITRE ATT&CK — T1053.005 Scheduled Task MITRE · Research · 2026-06-03
• Aspose.Email for .NET (legitimate OST/PST parsing library abused in campaign) products.aspose.com · Vendor report · 2026-06-03
• Global Stock Exchange Hit by Monthslong Email Campaign Dark Reading · News · 2026-06-03

Threats related to Aspose-based stock exchange OST theft

• Targeted Espionage Campaign Against a Global Stock Exchange Executive via Incremental Outlook OST Mailbox Theft and Living-off-the-Land Cloud Exfiltration

Previous and next in apt

• Operation XENOFISCAL — SideCopy (Transparent Tribe / APT36 umbrella) Deploys Persistent Customized XenoRAT 1.8.7 Against the Afghanistan Ministry of Finance Previous report
• VerdantBamboo (UNC5221 / WARP PANDA) BRICKSTORM Campaign — MSP Supply-Chain Compromise of Edge Appliances with 18-Month Dwell Next report