Global Stock Exchange Hit by Monthslong Email Campaign

Symantec and Carbon Black uncovered a months-long, highly targeted email espionage campaign against a senior executive at a major global stock exchange: attackers obtained administrative access, installed two implants disguised as legitimate software, used scheduled tasks for persistence, established C2 via Dropbox, and leveraged a custom infostealer built on the legitimate Aspose .NET library to convert and repeatedly exfiltrate the victim's Outlook emails from August 2025 through February 2026 before dropping additional backdoors and losing access in March 2026.