# Stock Exchange Executive Mailbox Espionage — Five-Month Intrusion via Masquerading SYSTEM Binaries (armsvc.exe / oneservice.exe), Aspose-Based OST Theft, and Dropbox/OneDrive C2 & Exfiltration

> Symantec/Broadcom documented a disciplined, five-month espionage intrusion that stole the Outlook mailbox of a senior executive at a major global stock exchange, exfiltrating it in incremental date-bounded batches via Dropbox and OneDrive Personal to blend with legitimate cloud traffic. The attackers ran masquerading binaries as SYSTEM (armsvc.exe posing as the Adobe Acrobat update service, oneservice.exe as a OneDrive helper), used the commercial Aspose .NET library to carve OST data by date range, and maintained persistence through frequent scheduled tasks named after Adobe, Lenovo, and OneDrive. The activity is unattributed.

- **Published:** 2026-06-03T00:00:00Z
- **Last reviewed:** 2026-06-03T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0672
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-aspose-based-stock-exchange-ost-theft-tl-2026-0672.webp?v=41e995db (Threadlinqs threat intel: Stock Exchange Executive Mailbox Theft: Detection & IOCs (TL-2026-0672) — High severity, 46 IOCs, 9 detection rules.)
- **ID:** TL-2026-0672
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 46 (3 shown free below)

## Description

Symantec's Threat Hunter Team disclosed a long-running, operationally disciplined espionage operation that compromised the host of a senior executive at a major global stock exchange and exfiltrated the executive's Outlook mailbox over roughly five months. The objective was pure intelligence collection — the executive's external negotiations, internal deliberations, calendar, travel patterns, and contacts — the kind of non-public, market-moving information an exchange holds about listings, enforcement actions, and corporate events. No ransomware, destruction, or lateral movement was needed; sustained mailbox access alone satisfied the objective.

When Symantec first observed activity on 10 October 2025, the attackers already held SYSTEM-level access: two masquerading binaries — armsvc.exe (path CSIDL_COMMON_APPDATA\adobe\arm\armsvc.exe, posing as the legitimate Adobe Acrobat Reader update service) and oneservice.exe (path CSIDL_PROFILE\appdata\local\microsoft\onedrive\setup\oneservice.exe, posing as a OneDrive setup helper) — were running as SYSTEM, each spawned by wininit.exe under the Service Control Manager. Local privilege escalation had therefore been achieved before the first observed activity (UAC bypass tooling, bypassuac.exe, was later seen on the host). Persistence was reinforced with high-frequency scheduled tasks masquerading as vendor maintenance jobs: an Adobe 'ARM Service' task firing every five minutes, OneDrive sync tasks every three minutes, and Lenovo 'CheckServerHealth' tasks at varying multi-hour intervals (300/900/1440 minutes) that launched batch files (c:\windows\temp\1.bat through 5.bat) and redirected output to matching .txt files.

The campaign entered its active phase on 12 November 2025 with an OAuth handshake that obtained a Dropbox API token, followed by the first Outlook OST extraction. The attackers used Aspose — a legitimate commercial .NET library for parsing Outlook OST/PST files — invoked as c:\windows\temp\Aspose.exe with a password (-p), the target OST (-f), an output directory (-o), and crucially a date-range flag (-t) such as 20250819-20251112. Subsequent runs narrowed the windows (20251112-20251121, 20251120-20251209, 20251209-20251216, and so on) at roughly two-to-four-week intervals through the final extraction on 17 February 2026, deliberately chunking the mailbox into small batches to stay under data-transfer and detection thresholds.

Command-and-control and exfiltration were built entirely on trusted public cloud services. A single persistent Dropbox application (constant client_id/client_secret, rotating per-session authorization codes) received uploads via curl POST to content.dropboxapi.com/2/files/upload with a Bearer token obtained from api.dropbox.com/oauth2/token. From 20-21 November the attackers added a OneDrive Personal channel (onedrive.live.com/personal/... _api AddUsingPath uploads) and briefly experimented with the public file-host temp.sh (51.91.79.17:443). To suppress telltale DNS lookups, the OneDrive channel was later switched to hard-coded Microsoft IP addresses 13.107.137.11 and 150.171.41.11. BeaconBeagle returned no matches for any network indicator — consistent with deliberate living-off-trusted-cloud tradecraft that leaves no dedicated C2 infrastructure to fingerprint.

Late in the campaign the attackers refreshed their toolset and persistence anchors: onedrivesync.exe (CSIDL_COMMON_APPDATA\microsoft onedrive\setup\onedrivesync.exe) was added as a persistence binary on 27 February 2026, and a previously unseen armdriver.exe (CSIDL_COMMON_APPDATA\adobe\arm\ondemand\armdriver.exe) plus te.host.dll (installed in CSIDL_COMMON_APPDATA\intel) appeared on 19 March 2026, the date of final observed activity. The mailbox-stealer payload itself was redeployed under rotating temp names (ts_9ea0.tmp, ts_e0d5.tmp, ts_e2d5.tmp — all sharing one SHA256) from CSIDL_WINDOWS\temp and nested skin/licenses subfolders. Public/offensive tooling observed on the host included curl.exe, SharpDecryptPwd (credential decryption), Secretsdump (Impacket credential dumping), FRPC (fast reverse proxy for tunneling), and UAC-bypass utilities. The exclusive reliance on public tools and legitimate cloud infrastructure left few identity clues, and Symantec did not attribute the activity to a known group, though the targeting and command patterns clearly indicate espionage motivation.

For defenders this intrusion is high-value detection-engineering material: concrete host artifacts (specific masquerading binary names and full paths, SYSTEM services spawned by wininit.exe, named high-frequency scheduled tasks impersonating Adobe/Lenovo/OneDrive), a distinctive Aspose OST-carving command line with date-range flags, and trusted-cloud C2/exfil patterns (Dropbox OAuth + upload, OneDrive AddUsingPath, hard-coded Microsoft IPs in curl to evade DNS) that demand behavioral rather than infrastructure-based detection.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1059 Command and Scripting Interpreter
- T1053 Scheduled Task/Job
- T1543 Create or Modify System Process
- T1548 Abuse Elevation Control Mechanism
- T1036 Masquerading
- T1685 Disable or Modify Tools
- T1003 OS Credential Dumping
- T1555 Credentials from Password Stores
- T1083 File and Directory Discovery
- T1114 Email Collection
- T1005 Data from Local System
- T1074 Data Staged
- T1560 Archive Collected Data
- T1071 Application Layer Protocol
- T1102 Web Service
- T1105 Ingress Tool Transfer
- T1572 Protocol Tunneling
- T1567 Exfiltration Over Web Service
- T1041 Exfiltration Over C2 Channel
- T1030 Data Transfer Size Limits

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**curl Exfiltration to Cloud Storage or Hard-Coded Microsoft IP (Splunk / SPL) - C2 / Exfiltration Phase** (`TL-2026-0672-SPL-003`)

Detects the trusted-cloud C2 and exfiltration channel of TL-2026-0672: curl.exe performing the Dropbox OAuth token exchange (api.dropbox.com/oauth2/token), chunked uploads (content.dropboxapi.com/2/files/upload), OneDrive Personal AddUsingPath uploads (onedrive.live.com), brief temp.sh (51.91.79.17) use, or direct-to-IP HTTPS to hard-coded Microsoft OneDrive addresses (13.107.137.11 / 150.171.41.11) that deliberately bypass DNS resolution to suppress telltale lookups.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1071.001, T1102.002, T1567.002, T1041, T1030, T1105
- **Data sources:** sysmon, microsoft_defender_endpoint, zeek_proxy
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 Image="*\\curl.exe"
`comment("TL-2026-0672 C2/exfil: curl to Dropbox/OneDrive cloud storage or hard-coded Microsoft IPs that bypass DNS")`
| search (CommandLine="*api.dropbox.com/oauth2/token*" OR CommandLine="*content.dropboxapi.com/2/files/upload*" OR CommandLine="*onedrive.live.com*" OR CommandLine="*_api/AddUsingPath*" OR CommandLine="*13.107.137.11*" OR CommandLine="*150.171.41.11*" OR CommandLine="*51.91.79.17*" OR CommandLine="*temp.sh*")
| eval channel=case(like(CommandLine,"%dropbox%"),"dropbox", (like(CommandLine,"%onedrive.live.com%") OR like(CommandLine,"%AddUsingPath%")),"onedrive_personal", (like(CommandLine,"%13.107.137.11%") OR like(CommandLine,"%150.171.41.11%")),"onedrive_hardcoded_ip_dns_evasion", (like(CommandLine,"%51.91.79.17%") OR like(CommandLine,"%temp.sh%")),"temp_sh", true(),"other")
| eval system_context=if(like(User,"%SYSTEM%"),"yes","no")
| table _time, host, User, ParentImage, Image, CommandLine, channel, system_context
| sort - _time
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
// TL-2026-0672 C2/exfil: curl to cloud-storage endpoints or hard-coded Microsoft IPs (DNS evasion)
| where FileName =~ "curl.exe"
| where ProcessCommandLine has_any ("api.dropbox.com/oauth2/token","content.dropboxapi.com/2/files/upload","onedrive.live.com","_api/AddUsingPath","13.107.137.11","150.171.41.11","51.91.79.17","temp.sh")
| extend Channel = case(
    ProcessCommandLine has "dropbox", "dropbox",
    ProcessCommandLine has "onedrive.live.com" or ProcessCommandLine has "AddUsingPath", "onedrive_personal",
    ProcessCommandLine has "13.107.137.11" or ProcessCommandLine has "150.171.41.11", "onedrive_hardcoded_ip_dns_evasion",
    ProcessCommandLine has "51.91.79.17" or ProcessCommandLine has "temp.sh", "temp_sh",
    "other")
| extend SystemContext = iff(InitiatingProcessAccountName =~ "system", "yes", "no")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, Channel, SystemContext
```

### Sigma

```yaml
title: curl Exfiltration to Cloud Storage or Hard-Coded Microsoft IP
id: 24e58241-3411-475e-ac17-cb7a55a96f8d
status: experimental
description: Detects the TL-2026-0672 trusted-cloud C2/exfiltration pattern - curl.exe contacting the Dropbox OAuth/upload APIs, OneDrive Personal AddUsingPath, the temp.sh file host, or hard-coded Microsoft OneDrive IPs (13.107.137.11 / 150.171.41.11) used to evade DNS-based egress monitoring.
references:
    - https://www.security.com/threat-intelligence/stock-exchange-espionage
    - https://attack.mitre.org/techniques/T1567/002/
    - https://attack.mitre.org/techniques/T1071/001/
author: AII-Detector - ThreadLinqs Intelligence
date: 2026/06/03
tags:
    - attack.command_and_control
    - attack.exfiltration
    - attack.t1071.001
    - attack.t1102.002
    - attack.t1567.002
    - attack.t1041
    - attack.t1030
logsource:
    product: windows
    category: process_creation
detection:
    selection_img:
        Image|endswith: '\curl.exe'
    selection_dst:
        CommandLine|contains:
            - 'api.dropbox.com/oauth2/token'
            - 'content.dropboxapi.com/2/files/upload'
            - 'onedrive.live.com'
            - '_api/AddUsingPath'
            - '13.107.137.11'
            - '150.171.41.11'
            - '51.91.79.17'
            - 'temp.sh'
    condition: selection_img and selection_dst
falsepositives:
    - Sanctioned corporate automation that legitimately uses curl with Dropbox/OneDrive Business APIs (personal-tenant endpoints and direct-to-IP calls remain suspicious)
level: high
```

**Known false positives:**

- Sanctioned corporate automation that legitimately uses curl with Dropbox/OneDrive Business APIs
- Software updaters or telemetry agents that fetch from Microsoft IP ranges (personal-tenant endpoints and direct-to-IP calls remain suspicious)

**Tuning notes:** Direct-to-IP HTTPS to 13.107.137.11 / 150.171.41.11 with no preceding DNS query, and any curl to onedrive.live.com personal-tenant or temp.sh, are the strongest signals - prioritize them over the broad domain matches. Escalate sharply when the parent/initiating account is SYSTEM. For network-telemetry coverage, mirror this against DeviceNetworkEvents / proxy logs (RemoteUrl or RemoteIP) and correlate with the Phase 2 Aspose carving and ts_*.tmp staging on the same host.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Vendor-Masquerading SYSTEM Foothold (wininit-Spawned Service / High-Frequency Scheduled Task) (Microsoft Defender / KQL) - Exploitation Phase (locked: unlock with TL Creds)
- Aspose-Style Outlook OST Date-Range Carving (Microsoft Defender / KQL) - Post-Exploitation / Collection Phase (locked: unlock with TL Creds)
- curl Exfiltration to Cloud Storage or Hard-Coded Microsoft IP (Microsoft Defender / KQL) - C2 / Exfiltration Phase (locked: unlock with TL Creds)
- Vendor-Masquerading SYSTEM Foothold (wininit-Spawned Service / High-Frequency Scheduled Task) (Sigma) - Exploitation Phase (locked: unlock with TL Creds)
- Aspose-Style Outlook OST Date-Range Carving (Sigma) - Post-Exploitation / Collection Phase (locked: unlock with TL Creds)
- curl Exfiltration to Cloud Storage or Hard-Coded Microsoft IP (Sigma) - C2 / Exfiltration Phase (locked: unlock with TL Creds)
- Vendor-Masquerading SYSTEM Foothold (wininit-Spawned Service / High-Frequency Scheduled Task) (Splunk / SPL) - Exploitation Phase (locked: unlock with TL Creds)
- Aspose-Style Outlook OST Date-Range Carving (Splunk / SPL) - Post-Exploitation / Collection Phase (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 46)

Defanged, TLP:CLEAR.

- IP address: `51.91.79[.]17`
- Domain: `api[.]dropbox[.]com`
- File hash: `db59813e3f27fb8608a4876e758f60b69d9700dc22d15237ac095bb3166fb622`

Full set of 46 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Espionage Campaign Targeted Stock Exchange Executive for Five Months](https://www.security.com/threat-intelligence/stock-exchange-espionage)
- [Global Stock Exchange Hit by Monthslong Email Campaign](https://www.darkreading.com/cyberattacks-data-breaches/global-stock-exchange-hit-monthslong-email-campaign)
- [MITRE ATT&CK — T1567.002 Exfiltration to Cloud Storage](https://attack.mitre.org/techniques/T1567/002/)
- [MITRE ATT&CK — T1036.005 Masquerading: Match Legitimate Name or Location](https://attack.mitre.org/techniques/T1036/005/)
- [MITRE ATT&CK — T1053.005 Scheduled Task](https://attack.mitre.org/techniques/T1053/005/)
- [Aspose.Email for .NET (legitimate OST/PST parsing library abused in campaign)](https://products.aspose.com/email/net/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0672