Hackers Spied on a Stock Exchange Executive's Outlook Mailbox for Five Months

Attackers maintained five-month access to a stock exchange executive's Outlook mailbox using a stealth approach that routed exfiltrated data through Dropbox and OneDrive to blend with legitimate cloud traffic.

• •Deployed an Aspose-based mailbox stealer to extract OST/PST files incrementally every 2-4 weeks, reducing detection risk
• •Routed exfiltration through personal cloud services and hard-coded Microsoft IPs instead of DNS-resolvable hostnames to evade monitoring
• •Masqueraded scheduled tasks as Adobe, Lenovo, and OneDrive system services to maintain persistence
• •Intrusion kit included FRPC tunneling, Secretsdump, SharpDecryptPwd, and UAC bypass tools indicating broader system compromise

This summary was automatically generated by AI based on the original article and may not be fully accurate.