cyber.hendryadrian.com
Cyber Attack & Data Breach · securityweek.com

Hackers Targeted Global Stock Exchange Executive in Suspected Espionage Campaign

· Original article ↗

Summary

Symantec and Carbon Black report that an attacker accessed a senior executive’s Outlook mailbox at an unnamed global stock exchange from October 2025 to March 2026, collecting and exfiltrating data in an operation likely aimed at espionage.

Key points

  • Symantec and Carbon Black investigators say an attacker retained access to a senior executive’s Outlook mailbox from October 2025 to March 2026.
  • The exchange and suspected threat actor were not identified; investigators assess espionage was the likely motive.
  • The initial access method is unknown. Malware disguised as Adobe and OneDrive applications was running by October 10, 2025.
  • The attacker began collecting and exfiltrating data on November 12, using Dropbox and OneDrive to transfer small batches.
  • The attacker repeatedly re-registered tasks disguised as Adobe, Lenovo, and OneDrive services to maintain access.
  • Symantec and Carbon Black published indicators of compromise to help organizations detect potential related activity.

Article Details

Victim Organization
Not disclosed
Incident Type
Espionage operation involving malware on a compromised host, unauthorized access to a senior executive’s Outlook mailbox, and data exfiltration.
Incident Date
2025-10-10
Data Types Exposed
  • Outlook mailbox contents
  • Files
Affected Records
Unknown
Affected Data Size
Unknown
Operational Impact
The attacker retained access to the compromised mailbox from October 2025 until March 2026 and exfiltrated data in small batches. No wider operational disruption is reported.
Claim Status
confirmed

MITRE ATT&CK

T1053.005 · Scheduled TaskThe attacker regularly re-registered tasks disguised as system services to maintain persistence.T1567.002 · Exfiltration to Cloud StorageThe attacker used Dropbox and OneDrive to exfiltrate files.

Vendors

BroadcomThe attack, investigated by Broadcom’s Symantec and Carbon Black threat-hunting team, began in October 2025, and the threat actor retained access to the compromised Outlook mailbox until March 2026.Carbon BlackThe attack, investigated by Broadcom’s Symantec and Carbon Black threat-hunting team, began in October 2025, and the threat actor retained access to the compromised Outlook mailbox until March 2026.SymantecThe attack, investigated by Broadcom’s Symantec and Carbon Black threat-hunting team, began in October 2025, and the threat actor retained access to the compromised Outlook mailbox until March 2026.

Products

Dropbox DocSendTo avoid raising suspicion, they used Dropbox and OneDrive to exfiltrate files, transferring only small batches at a time.Microsoft OneDriveOctober 10, 2025, when malware had already been running on the compromised host, disguised as Adobe and OneDrive applications. OutlookThe attack, investigated by Broadcom’s Symantec and Carbon Black threat-hunting team, began in October 2025, and the threat actor retained access to the compromised Outlook mailbox until March 2026.

Related Articles