Cyber Espionage Campaign Targets Global Stock Exchange Executive

A disciplined five-month executive espionage campaign against a major financial institution covertly harvested a senior leader’s Outlook mailboxes using a custom data-stealer built around a legitimate .NET library, maintained SYSTEM-level persistence via masquerading binaries and recurrent scheduled tasks, and exfiltrated small incremental archives through a persistent Dropbox app and a OneDrive channel using hard-coded IPs to evade DNS-based detection; the intrusion is sophisticated, stealthy, and remains unattributed.