Targeted Espionage Campaign Against a Global Stock Exchange Executive via Incremental Outlook OST Mailbox Theft and Living-off-the-Land Cloud Exfiltration

Key facts for Stock Exchange Espionage

Detection coverage for Stock Exchange Espionage

As of 2026-06-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0755 across Splunk SPL, Microsoft KQL and Sigma, covering 45 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Non-Outlook Process Reading OST Offline Cache / OST-to-PST Conversion — Exploitation

Detects the campaign's core mailbox-theft mechanic: an Aspose-wrapped stealer (delivered as ts_*.tmp) reading the victim's Outlook OST offline cache and writing PST output, performed by a process other than outlook.exe. Correlates file access to *.ost / *.pst by non-Outlook images and the staging of ts_*.tmp markers in c:\windows emp. This is local email collection (T1114.001) and data-from-local-system (T1005), the highest-fidelity early signal of the intrusion.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1114.001, T1005
• Data sources: sysmon, windows_security, microsoft_defender_for_endpoint
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=11 OR EventCode=1)
| where (like(TargetFilename, "%.ost") OR like(TargetFilename, "%.pst") OR like(TargetFilename, "%\\windows\\temp\\ts_%.tmp"))
| eval proc=lower(coalesce(Image, ""))
| search NOT proc IN ("*\\outlook.exe", "*\\onedrive.exe", "*\\searchindexer.exe", "*\\searchprotocolhost.exe")
| eval suspicious_temp=if(like(TargetFilename,"%\\windows\\temp\\ts_%.tmp"),1,0)
| stats count, values(TargetFilename) as files, values(Image) as images, min(_time) as first_seen, max(_time) as last_seen by Computer, proc
| where count >= 1
| sort - count

Microsoft KQL

// Non-Outlook process touching OST/PST cache or staging ts_*.tmp stealer markers
union DeviceFileEvents, DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName endswith ".ost" or FileName endswith ".pst"
        or FolderPath has @"\windows\temp\" and FileName startswith "ts_" and FileName endswith ".tmp")
| extend Proc = tolower(InitiatingProcessFileName)
| where Proc !in ("outlook.exe", "onedrive.exe", "searchindexer.exe", "searchprotocolhost.exe", "backup.exe")
| project Timestamp, DeviceName, Proc, InitiatingProcessFolderPath, FileName, FolderPath, ActionType, InitiatingProcessCommandLine
| sort by Timestamp desc

Sigma

title: Non-Outlook Process Accessing Outlook OST Offline Cache
id: 3f2b1c64-0a55-4e91-9d77-0755ostread01
status: experimental
description: Detects an OST/PST offline mailbox cache being read or written by a process other than Outlook, matching the TL-2026-0755 Aspose-based OST-to-PST stealer.
references:
    - https://www.security.com/threat-intelligence/stock-exchange-espionage
    - https://attack.mitre.org/techniques/T1114/001/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/06/10
tags:
    - attack.collection
    - attack.t1114.001
    - attack.t1005
logsource:
    product: windows
    category: file_access
detection:
    selection:
        FileName|endswith:
            - '.ost'
            - '.pst'
    filter_legit:
        Image|endswith:
            - '\outlook.exe'
            - '\OneDrive.exe'
            - '\SearchIndexer.exe'
            - '\SearchProtocolHost.exe'
    condition: selection and not filter_legit
falsepositives:
    - Backup or mail-archiving agents that legitimately read OST/PST files
    - eDiscovery or migration tooling
level: high

Known false positives:

• Enterprise backup or mail-archiving agents reading OST/PST files
• eDiscovery, indexing, or mailbox-migration tooling accessing offline caches

Tuning notes: Allow-list your sanctioned backup/archive/index binaries by full signed path rather than image name to prevent masquerade evasion. Raise severity when the accessing process also wrote a ts_*.tmp marker in c:\windows emp in the same session.

• 🔒 Incremental OST-to-PST Extraction by ts_*.tmp Stealer with Date-Range Window — Exploitation · unlock with TL Creds
• 🔒 SYSTEM Binary Spawned by wininit.exe from Vendor Masquerade Path + Credential Dumping — Post-Exploitation · unlock with TL Creds
• 🔒 FRPC Reverse-Proxy Tunneling / Internal Proxy C2 — Command and Control · unlock with TL Creds
• 🔒 Staging of ts_*.tmp Stealer Markers and Incremental PST Batches in Temp — Exploitation · unlock with TL Creds
• 🔒 Batch-File Re-Registration of Masquerading Scheduled Tasks — Post-Exploitation · unlock with TL Creds
• 🔒 DNS-less Outbound to Hard-coded Microsoft / [indicator] Exfil IPs — Exfiltration · unlock with TL Creds
• 🔒 Masquerading Scheduled Task Impersonating Vendor Service Paths at Short Intervals — Post-Exploitation · unlock with TL Creds
• 🔒 curl LOLBin Cloud Exfiltration with OAuth2 Bearer Token / Hard-coded Microsoft IPs — C2 & Exfiltration · unlock with TL Creds

Indicators of compromise for Stock Exchange Espionage

As of 2026-06-10, Threadlinqs Intelligence tracks 45 indicators of compromise for TL-2026-0755.

Sample indicators (3 of 45)

• IP address: 13.107.137[.]11
• Domain: content[.]dropboxapi[.]com
• File hash: db59813e3f27fb8608a4876e758f60b69d9700dc22d15237ac095bb3166fb622

Defanged, TLP:CLEAR. Full set of 45 indicators: unlock with TL Creds.

How Stock Exchange Espionage works

Symantec/Security.com documented a long-dwell, highly disciplined espionage intrusion targeting a senior executive at a major global stock exchange. First malicious activity was observed on 10 October 2025, by which point the attackers had already achieved local privilege escalation and deployed at least two masquerading binaries; the operation continued until at least 19 March 2026, giving an approximate five-month dwell time.

The core objective was theft of the victim's Outlook mailbox. The actor deployed a custom OST stealer that wrapped the legitimate Aspose .NET email library inside a bespoke executable (delivered as ts_9ea0.tmp, ts_e0d5.tmp and ts_e2d5.tmp - all sharing an identical SHA256). The stealer converted offline OST cache files to PST and used date-range windows (a -t flag) to extract mail incrementally: the first run pulled everything from August 2025 onward, while subsequent runs (approximately 12 extraction cycles over five months) captured only recent days. This incremental approach deliberately avoided large, alert-triggering uploads.

The attackers ran as SYSTEM through the Service Control Manager; malicious binaries spawned by wininit.exe confirm that LOCAL privilege escalation had been achieved before observation began. Persistence was layered across multiple masquerading binaries and scheduled tasks impersonating Adobe ARM, Microsoft OneDrive sync, and Lenovo CheckServerHealth services, with batch files (1.bat-5.bat) in c:\windows\temp\ re-registering tasks at varying intervals (3, 5, 300, 900 and 1440 minutes) to guarantee continuous execution.

Exfiltration relied entirely on legitimate, allow-listed cloud infrastructure used via curl: a persistent Dropbox OAuth2 application (client_id/client_secret reused, only authorization codes rotated) uploading to content.dropboxapi.com; OneDrive Personal, which after an initial DNS-based attempt against onedrive.live.com switched to hard-coded Microsoft IP addresses (13.107.137.11, 150.171.41.11) to avoid DNS queries; and brief experimentation with temp.sh (51.91.79.17) over three HTTPS connections before abandonment. Supporting tooling included SharpDecryptPwd and Impacket secretsdump for credential access, FRPC (Fast Reverse Proxy Client) for tunneling/C2, and bypassuac.exe variants for UAC bypass. The likely motivation is espionage against non-public market information - listings, enforcement actions, or market-moving events.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003.002 Security Account Manager; T1555 Credentials from Password Stores

Collection

T1005 Data from Local System; T1074.001 Local Data Staging; T1114.001 Local Email Collection

Exfiltration

T1020 Automated Exfiltration; T1567 Exfiltration Over Web Service; T1567.002 Exfiltration to Cloud Storage

Defense Evasion

T1036.003 Rename Legitimate Utilities; T1036.005 Match Legitimate Resource Name or Location; T1078 Valid Accounts; T1218 System Binary Proxy Execution

Execution

T1053.005 Scheduled Task; T1569.002 Service Execution

Persistence

T1053.005 Scheduled Task; T1078 Valid Accounts; T1543.003 Windows Service; T1546.015 Component Object Model Hijacking

Command and Control

T1071.001 Web Protocols; T1090.001 Internal Proxy; T1105 Ingress Tool Transfer; T1572 Protocol Tunneling

Initial Access

T1078 Valid Accounts

Discovery

T1087 Account Discovery

Privilege Escalation

T1134 Access Token Manipulation; T1548.002 Bypass User Account Control

Lateral Movement

T1563 Remote Service Session Hijacking

stealth

T1574.001 DLL

Remediation for Stock Exchange Espionage

Immediate actions

• Hunt for and block the published SHA256 file hashes across EDR/AV.
• Audit scheduled tasks under \Microsoft\Windows\Adobe\ARM Service, \Microsoft\Windows\Lenovo\CheckServerHealth, and \Microsoft\Windows\MicrosoftOneDriveSyncServiceCore for unsigned or out-of-place binaries.
• Inspect c:\windows\temp\ for 1.bat-5.bat and ts_*.tmp artifacts and remove them.
• Review outbound curl connections to content.dropboxapi.com, onedrive.live.com, and hard-coded Microsoft IPs 13.107.137.11 / 150.171.41.11, plus any traffic to 51.91.79.17 (temp.sh).
• Reset credentials for the targeted executive and any accounts accessible from the compromised host; revoke Dropbox/OneDrive OAuth grants the user did not create.

Workarounds

• Restrict execution of curl.exe via WDAC/AppLocker on sensitive endpoints.
• Disable creation of non-administrative scheduled tasks impersonating vendor service paths.

Longer-term hardening

• Deploy behavioral EDR detections for OST-to-PST conversion and OST files read by non-Outlook processes.
• Implement DLP/egress controls and OAuth app governance for sanctioned cloud storage (Dropbox, OneDrive Personal).
• Alert on curl.exe and other LOLBins making outbound HTTPS to consumer cloud endpoints from server/executive endpoints.
• Enforce least privilege and monitor SYSTEM-level service creation and wininit.exe child processes.
• Block or tightly control personal/consumer cloud-storage domains on corporate egress for high-value users.

Affected and fixed versions

• Microsoft — Outlook / Exchange (OST offline cache)
  Vulnerable versions: OST mailbox cache on compromised endpoint
• Microsoft — Windows (endpoint, SYSTEM/SCM abuse)
  Vulnerable versions: Windows endpoint of targeted executive

Timeline of Stock Exchange Espionage

• 2025-08-01 Earliest mailbox data captured: first OST stealer run extracted mail from August 2025 onward, predating observed activity.
• 2025-10-10 First malicious activity observed; two masquerading binaries already deployed and local privilege escalation already achieved.
• 2025-11-12 Active phase begins: Dropbox OAuth2 handshake completed and OST stealer scheduled tasks registered.
• 2025-11-20 Three HTTPS connections to locked-ioc-45 (locked-ioc-44:443) using curl -F for file uploads; channel later abandoned.
• 2025-11-21 OneDrive Personal exfiltration channel added; initial attempt against locked-ioc-40, then switched to hard-coded Microsoft IPs to avoid DNS.
• 2026-02-27 Additional persistence anchor deployed: onedrivesync.exe with scheduled task MicrosoftOneDriveSyncServiceCore at 3-minute intervals.
• 2026-03-19 Last observed activity: armdriver.exe and te.host.dll deployed; campaign dwell time approximately five months.
• 2026-06-03 Campaign publicly documented by Symantec/Security.com Threat Intelligence with 20+ file hashes and 3 IP IOCs.

Sources cited for Stock Exchange Espionage

• Espionage Campaign Against Stock Exchange Executive security.com · Research · 2026-06-03
• MITRE ATT&CK T1114 - Email Collection MITRE · Research · 2026-06-03
• MITRE ATT&CK T1567.002 - Exfiltration to Cloud Storage MITRE · Research · 2026-06-03
• MITRE ATT&CK T1053.005 - Scheduled Task MITRE · Research · 2026-06-03
• MITRE ATT&CK T1036.005 - Masquerading: Match Legitimate Name or Location MITRE · Research · 2026-06-03
• Aspose.Email for .NET (OST/PST library abused by stealer) products.aspose.com · Vendor report · 2026-06-03
• Impacket (secretsdump) - Fortra/SecureAuth GitHub · Code repository · 2026-06-03
• FRP - Fast Reverse Proxy (FRPC) GitHub · Code repository · 2026-06-03
• SharpDecryptPwd - credential recovery tool GitHub · Code repository · 2026-06-03

Threats related to Stock Exchange Espionage

• Stock Exchange Executive Mailbox Espionage — Five-Month Intrusion via Masquerading SYSTEM Binaries (armsvc.exe / oneservice.exe), Aspose-Based OST Theft, and Dropbox/OneDrive C2 & Exfiltration
• Head Mare APT Exploits Unpatched TrueConf Server Flaws to Deploy PhantomCore and PhantomGraph Backdoors

Previous and next in apt

• Seedworm (MuddyWater) Iranian MOIS APT Deploys Dindoor and Fakeset Backdoors Against U.S. Bank, Airport, and Defense Software Company Next report