Five-Month Espionage Campaign Targeted Stock Exchange Executive’s Outlook Mailbox
Summary
Investigators detailed a five-month intrusion targeting a stock exchange executive’s Outlook mailbox, with incremental OST extraction and exfiltration via Dropbox and OneDrive Personal. The initial infection vector and attacker identity remain unknown.
Key points
- The campaign targeted one senior executive’s Outlook mailbox at a major global stock exchange; the initial infection vector is unknown.
- Investigators observed repeated, date-range-based extraction of Outlook OST data using an Aspose-based tool, enabling near-continuous mailbox collection over about five months.
- Dropbox was used for uploads and downloads; the same application credentials were reused during the observed activity.
- OneDrive Personal was added as another exfiltration channel, with hard-coded Microsoft IP addresses used to avoid DNS queries for its hostname.
- Masquerading binaries and frequently recreated scheduled tasks helped maintain persistence and disguise activity as legitimate services.
- The attackers briefly connected to a temporary file-hosting service, but investigators observed no further use of that channel after November 21, 2025.
- The initial access method and attacker identity were not established; the report says the observed commands point to espionage as the likely motivation.
Article Details
- Attack Vectors
- The initial infection vector is unknown; the first observed malicious activity was two masquerading binaries running as SYSTEM.
- Scheduled tasks repeatedly ran malicious components, including an Aspose-based stealer that extracted Outlook OST data in incremental date ranges.
- The attackers used Dropbox API traffic and OneDrive Personal to exfiltrate mailbox data; OneDrive requests later used hard-coded Microsoft IP addresses.
- The attackers briefly uploaded a staged file to temp.sh.
- Defensive Notes
- The article directs readers to the Symantec Protection Bulletin for the latest protection updates.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 02048121fd0b3a51751ce7677155aa8818eba9d8ce67ea26fd1d7f43cfcdabd2 | SHA-256 hash listed for the masquerading executable armdriver.exe. |
| SHA256 | 22f335a65c479c26019f6187dae290624117c82a702a96acbb04fa325f730d3e | SHA-256 hash listed for the masquerading executable oneservice.exe. |
| SHA256 | 308351124c496d4f4effee65ab828506abf70385773c167ab1f32a7f030385ac | SHA-256 hash listed for BypassUAC (bypassuac.exe), an artifact in the campaign IOC list. |
| SHA256 | 3aae5a24e63f3cb1ca4759b9e4ee8e503ff139189423f5fd8cc923c6819697ca | SHA-256 hash listed for a masquerading executable (sepservice.exe). |
| SHA256 | 3b6cb20891bce8602ce669187754871e402a1782031ef8b032cd007e3894bc5d | SHA-256 hash listed for a malicious executable (sidehost.exe). |
| SHA256 | 611db3195d55e871dce67ce5c41e894bbaab88dd0d019af68f5a259f0108aef7 | SHA-256 hash listed for a suspicious file (sddsvc.exe) in the campaign IOC list. |
| SHA256 | 6a69ea2ce3fea0ebfd7a32a1dfc4251bd4d7d8a4fbd44aaa47b82290d0414a9f | SHA-256 hash listed for a masquerading executable (appsvc.exe). |
| SHA256 | 6c700ca4e6d917c7aa9d964e98604a0349d9b8b4673df96a3f73a3d2d042635a | SHA-256 hash of te.host.dll, identified in the article as a malicious DLL staged in the campaign. |
| SHA256 | 8b283c954d19a839a724961ccaf025c56988c4e745acb2d31a15a006cda072bf | SHA-256 hash listed for a masquerading executable (sepservice.exe). |
| SHA256 | 8c0871cd0f60bc603424e948a689945a1828d0bef926a6470ae18cf17d93f7cb | SHA-256 hash listed for a masquerading executable (armsvc.exe). |
| SHA256 | acf5ed6e5bb90c44683938f35efeca551428064cdedbbaab8be69e3474fb806f | SHA-256 hash listed for a suspicious file (ss.exe) in the campaign IOC list. |
| SHA256 | c3405d9c9d593d75d773c0615254e69d0362954384058ee970a3ec0944519c37 | SHA-256 hash listed for Secretsdump, an artifact in the campaign IOC list. |
| SHA256 | cf731b82c471211938b210ae8a6dcc7ece4f44371e716f056fa05151a9910727 | SHA-256 hash listed for a masquerading executable (armsvc.exe). |
| SHA256 | d5e42104292513232d26ad7d9d317b5c779577da43e28fe27f8c2fb9318b0e8e | SHA-256 hash listed for a malicious executable (sidehost.exe). |
| SHA256 | d78f64551d1b31a31e5998e442f0debd458e011e05019b3951d9ddde997f8384 | SHA-256 hash listed for BypassUAC (bypassuac.exe), an artifact in the campaign IOC list. |
| SHA256 | db59813e3f27fb8608a4876e758f60b69d9700dc22d15237ac095bb3166fb622 | SHA-256 hash identified for the mailbox infostealer used to extract Outlook OST data. |
| SHA256 | eaff006ac0eb7f7fe4db5fc6a4b5b1dc272d83ced66d510dcea185b1278bb453 | SHA-256 hash listed for a masquerading executable (armsvc.exe). |
| SHA256 | f72a8b71f12eaab6518873f72ea4be4572d9f3fb8e8706ade3b9a7314f236f22 | SHA-256 hash listed for the masquerading executable onedrivesync.exe. |
MITRE ATT&CK
T1036 · MasqueradingBinaries and scheduled-task names imitated Adobe, Lenovo, OneDrive, and Microsoft components.T1041 · Exfiltration Over C2 ChannelMailbox data was uploaded through Dropbox API traffic, which the article also describes as command-and-control infrastructure.T1053.005 · Scheduled TaskThe attackers repeatedly created scheduled tasks to run malicious components at intervals, including the OST stealer.T1071.001 · Web ProtocolsThe campaign used HTTPS requests, including curl requests to Dropbox, OneDrive, and temp.sh endpoints.T1105 · Ingress Tool TransferMalicious executables and DLL components were placed in Windows temporary directories and reused on the host.T1114.001 · Local Email CollectionAn Aspose-based stealer read the target user's local Outlook OST file and extracted mailbox contents.T1567.002 · Exfiltration to Cloud StorageThe attackers exfiltrated mailbox data through Dropbox and OneDrive Personal.
Vendors
AsposeThe attackers relied on masquerading binaries, scheduled tasks, and an Aspose-based OST stealer to maintain persistence and avoid detection while stealing near-continuous email content.Dropboxespionage campaign targeted a senior executive’s Outlook mailbox at a major global stock exchange, using Dropbox, OneDrive Personal, and temporary hosting services to quietly exfiltrate mailbox data in small batches.MicrosoftOneDrive Personal was later added as a second exfiltration path, including connections to hard-coded Microsoft IP addresses to reduce DNS-based visibility.
Products
Dropbox DocSendespionage campaign targeted a senior executive’s Outlook mailbox at a major global stock exchange, using Dropbox, OneDrive Personal, and temporary hosting services to quietly exfiltrate mailbox data in small batches.Microsoft WindowsThe intruders relied on masquerading binaries, service-like scheduled tasks, and Windows temp directories to blend into normal system activity.OneDrive Personaltargeted a senior executive’s Outlook mailbox at a major global stock exchange, using Dropbox, OneDrive Personal, and temporary hosting services to quietly exfiltrate mailbox data in small batches.OutlookA five-month espionage campaign targeted a senior executive’s Outlook mailbox at a major global stock exchange, using Dropbox, OneDrive Personal, and temporary hosting services to quietly exfiltrate mailbox data in