Espionage Campaign Compromises Senior Executive Email at Global Stock Exchange for Five Months
What Happened — A sophisticated espionage actor gained persistent access to the Outlook mailbox of a senior executive at a major global stock exchange and maintained control for five months. The attackers used masquerading binaries, scheduled tasks, and legitimate cloud services (Dropbox, OneDrive) to exfiltrate email contents and internal intelligence.
Why It Matters for TPRM —
- Email compromise of a senior market‑maker provides attackers with non‑public trading, listing, and regulatory information that can be weaponized against counterparties.
- The use of legitimate cloud services for C2 and exfiltration makes detection difficult, highlighting gaps in third‑party cloud monitoring.
- Persistent, low‑noise intrusions illustrate the need for continuous credential hygiene and mailbox activity analytics for high‑value third‑party contacts.
Who Is Affected — Financial services – stock exchanges, market regulators, and any third‑party vendors that support executive communications (e.g., email hosting, cloud storage).
Recommended Actions —
- Review and enforce MFA and conditional access for all senior‑executive mailboxes.
- Deploy mailbox‑specific anomaly detection (impossible travel, unusual file downloads, OAuth token grants).
- Audit third‑party cloud usage (Dropbox, OneDrive) for unauthorized API tokens and data flows.
- Conduct a targeted threat‑hunt for the masquerading binaries (armsvc.exe, oneservice.exe) and related scheduled tasks.
Technical Notes —
- Initial infection vector unknown; attackers achieved SYSTEM privileges via two disguised binaries (armsvc.exe mimicking Adobe Acrobat update, oneservice.exe mimicking OneDrive setup).
- Persistence via a five‑minute scheduled task under a Microsoft‑Adobe name.
- OAuth handshake used to obtain a Dropbox API token for exfiltration; legitimate cloud services served as C2.
- No attribution to known APT groups; tactics align with espionage motives. Source: Broadcom Symantec Blog