Targeted Espionage Campaign Against a Global Stock Exchange Executive via Incremental Outlook OST Mailbox Theft and Living-off-the-Land Cloud Exfiltration
Targeted Espionage Campaign Against a Global Stock Exchange (TL-2026-0755), also tracked as Stock Exchange Espionage, is a high-severity advanced persistent threat campaign, first published 2026-06-10. It has no confirmed attribution, affects Microsoft Outlook / Exchange (OST offline cache), maps to 25 MITRE ATT&CK techniques (T1003.002, T1005, T1020), and is covered by 9 detection rules and 45 indicators of compromise.
Key facts for TL-2026-0755
- Threat ID
- TL-2026-0755
- Also known as
- Stock Exchange Espionage
- Severity
- HIGH
- Status
- ACTIVE
- Category
- APT
- First published
- 2026-06-10
- Last reviewed
- 2026-06-10
- Attribution confidence
- NONE
- Motivation
- ESPIONAGE
- Target sectors
- financial, stock exchange, capital markets
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 45
Malware and tooling in Targeted Espionage Campaign Against a Global Stock Exchange
Malware and tooling: Aspose .NET email library, FRPC (Fast Reverse Proxy Client), Impacket secretsdump, SharpDecryptPwd
An unattributed threat actor ran a roughly five-month espionage operation (Oct 2025 - Mar 2026) against a senior figure at a major global stock exchange, stealing the victim's Outlook mailbox in small incremental batches by converting OST files to PST with an Aspose-based stealer and exfiltrating the data through legitimate cloud services (Dropbox, OneDrive Personal, temp.sh) to blend with normal traffic.
How Targeted Espionage Campaign Against a Global Stock Exchange works
Symantec/Security.com documented a long-dwell, highly disciplined espionage intrusion targeting a senior executive at a major global stock exchange. First malicious activity was observed on 10 October 2025, by which point the attackers had already achieved local privilege escalation and deployed at least two masquerading binaries; the operation continued until at least 19 March 2026, giving an approximate five-month dwell time.
The core objective was theft of the victim's Outlook mailbox. The actor deployed a custom OST stealer that wrapped the legitimate Aspose .NET email library inside a bespoke executable (delivered as ts_9ea0.tmp, ts_e0d5.tmp and ts_e2d5.tmp - all sharing an identical SHA256). The stealer converted offline OST cache files to PST and used date-range windows (a -t flag) to extract mail incrementally: the first run pulled everything from August 2025 onward, while subsequent runs (approximately 12 extraction cycles over five months) captured only recent days. This incremental approach deliberately avoided large, alert-triggering uploads.
The attackers ran as SYSTEM through the Service Control Manager; malicious binaries spawned by wininit.exe confirm that LOCAL privilege escalation had been achieved before observation began. Persistence was layered across multiple masquerading binaries and scheduled tasks impersonating Adobe ARM, Microsoft OneDrive sync, and Lenovo CheckServerHealth services, with batch files (1.bat-5.bat) in c:\windows emp\ re-registering tasks at varying intervals (3, 5, 300, 900 and 1440 minutes) to guarantee continuous execution.
Exfiltration relied entirely on legitimate, allow-listed cloud infrastructure used via curl: a persistent Dropbox OAuth2 application (client_id/client_secret reused, only authorization codes rotated) uploading to content.dropboxapi.com; OneDrive Personal, which after an initial DNS-based attempt against onedrive.live.com switched to hard-coded Microsoft IP addresses (13.107.137.11, 150.171.41.11) to avoid DNS queries; and brief experimentation with temp.sh (51.91.79.17) over three HTTPS connections before abandonment. Supporting tooling included SharpDecryptPwd and Impacket secretsdump for credential access, FRPC (Fast Reverse Proxy Client) for tunneling/C2, and bypassuac.exe variants for UAC bypass. The likely motivation is espionage against non-public market information - listings, enforcement actions, or market-moving events.
MITRE ATT&CK techniques used in TL-2026-0755
Credential Access
T1003.002 Security Account Manager; T1555 Credentials from Password Stores
Collection
T1005 Data from Local System; T1074.001 Local Data Staging; T1114.001 Local Email Collection
Exfiltration
T1020 Automated Exfiltration; T1567 Exfiltration Over Web Service; T1567.002 Exfiltration to Cloud Storage
Defense Evasion
T1036.003 Rename Legitimate Utilities; T1036.005 Match Legitimate Resource Name or Location; T1078 Valid Accounts; T1218 System Binary Proxy Execution
Execution
T1053.005 Scheduled Task; T1569.002 Service Execution
Persistence
T1053.005 Scheduled Task; T1078 Valid Accounts; T1543.003 Windows Service; T1546.015 Component Object Model Hijacking
Command and Control
T1071.001 Web Protocols; T1090.001 Internal Proxy; T1105 Ingress Tool Transfer; T1572 Protocol Tunneling
Initial Access
Discovery
Privilege Escalation
T1134 Access Token Manipulation; T1548.002 Bypass User Account Control
Lateral Movement
T1563 Remote Service Session Hijacking
stealth
Affected products and versions in Targeted Espionage Campaign Against a Global Stock Exchange
- Microsoft — Outlook / Exchange (OST offline cache)
Vulnerable versions: OST mailbox cache on compromised endpoint - Microsoft — Windows (endpoint, SYSTEM/SCM abuse)
Vulnerable versions: Windows endpoint of targeted executive
Remediation for Targeted Espionage Campaign Against a Global Stock Exchange
Immediate actions
- Hunt for and block the published SHA256 file hashes across EDR/AV.
- Audit scheduled tasks under \Microsoft\Windows\Adobe\ARM Service, \Microsoft\Windows\Lenovo\CheckServerHealth, and \Microsoft\Windows\MicrosoftOneDriveSyncServiceCore for unsigned or out-of-place binaries.
- Inspect c:\windows\temp\ for 1.bat-5.bat and ts_*.tmp artifacts and remove them.
- Review outbound curl connections to content.dropboxapi.com, onedrive.live.com, and hard-coded Microsoft IPs 13.107.137.11 / 150.171.41.11, plus any traffic to 51.91.79.17 (temp.sh).
- Reset credentials for the targeted executive and any accounts accessible from the compromised host; revoke Dropbox/OneDrive OAuth grants the user did not create.
Workarounds
- Restrict execution of curl.exe via WDAC/AppLocker on sensitive endpoints.
- Disable creation of non-administrative scheduled tasks impersonating vendor service paths.
Longer-term hardening
- Deploy behavioral EDR detections for OST-to-PST conversion and OST files read by non-Outlook processes.
- Implement DLP/egress controls and OAuth app governance for sanctioned cloud storage (Dropbox, OneDrive Personal).
- Alert on curl.exe and other LOLBins making outbound HTTPS to consumer cloud endpoints from server/executive endpoints.
- Enforce least privilege and monitor SYSTEM-level service creation and wininit.exe child processes.
- Block or tightly control personal/consumer cloud-storage domains on corporate egress for high-value users.
Timeline of Targeted Espionage Campaign Against a Global Stock Exchange
- Earliest mailbox data captured: first OST stealer run extracted mail from August 2025 onward, predating observed activity.
- First malicious activity observed; two masquerading binaries already deployed and local privilege escalation already achieved.
- Active phase begins: Dropbox OAuth2 handshake completed and OST stealer scheduled tasks registered.
- Three HTTPS connections to temp.sh (51.91.79.17:443) using curl -F for file uploads; channel later abandoned.
- OneDrive Personal exfiltration channel added; initial attempt against onedrive.live.com, then switched to hard-coded Microsoft IPs to avoid DNS.
- Additional persistence anchor deployed: onedrivesync.exe with scheduled task MicrosoftOneDriveSyncServiceCore at 3-minute intervals.
- Last observed activity: armdriver.exe and te.host.dll deployed; campaign dwell time approximately five months.
- Campaign publicly documented by Symantec/Security.com Threat Intelligence with 20+ file hashes and 3 IP IOCs.
Sources cited for Targeted Espionage Campaign Against a Global Stock Exchange
- Espionage Campaign Against Stock Exchange Executive
- MITRE ATT&CK T1114 - Email Collection
- MITRE ATT&CK T1567.002 - Exfiltration to Cloud Storage
- MITRE ATT&CK T1053.005 - Scheduled Task
- MITRE ATT&CK T1036.005 - Masquerading: Match Legitimate Name or Location
- Impacket (secretsdump) - Fortra/SecureAuth
- FRP - Fast Reverse Proxy (FRPC)
- Aspose.Email for .NET (OST/PST library abused by stealer)
- SharpDecryptPwd - credential recovery tool
Threats related to Targeted Espionage Campaign Against a Global Stock Exchange
Detection coverage for TL-2026-0755
As of 2026-06-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0755 across Splunk SPL, Microsoft KQL and Sigma, covering 45 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.