Five‑Month Espionage Campaign Hijacked Stock Exchange Executive’s Email via Cloud‑Based Exfiltration
A sophisticated threat actor stole a senior stock‑exchange executive’s Outlook mailbox and exfiltrated data for five months using legitimate cloud services such as Dropbox and OneDrive to mask activity. The attackers deployed masquerading binaries for persistence and leveraged public tools, illustrating the high‑value nature of executive email in financial espionage.