GoKawiilAn unknown hacker or hackers managed to spy on a senior member of an unnamed global stock exchange for at least five months.
Lots of questions still surround an email spying campaign reported by Symantec and Carbon Black this week, like who was behind it and how they obtained initial access. What's clear is that some threat actor subtly, meticulously crept into a high-ranking finance executive's Microsoft Outlook mailbox and siphoned off months' worth of emails.
Those emails likely contained intimate information about the target's organization, from contacts and calendar events to the details of specific business deals. Considering the nature of the target's organization — a major financial exchange — that intelligence could have been of significant value to businesses, investors, or a foreign government.
"Organizations such as exchanges and regulators may hold non-public information about listings, enforcement actions, and market-moving events," the researchers wrote in a blog post. "Months of unfettered access to that mailbox lets an attacker build a near-complete picture of the target's working life and the organization's near-term direction."
Related:DriveSurge Hijacks Thousands of Sites for ClickFix, FakeUpdate Attacks
Exchange Executive's Email Espionage
Cybersecurity researchers often uncover malware or malicious behaviors designed to be stealthy. Though these cases usually are novel and interesting, they're typically failures to some degree, since, if they were really stealthy, they'd have never ended up in a research report.
It may be a testament to the threat actor in this story that by the time cyber defenders realized something was afoot, the actor had already broken into their target's system and gained complete administrative access.
We still don't know how they managed to do all that. The recorded part of the story began later, Oct. 10, 2025. Marc Elias, threat intelligence analyst for the Symantec and Carbon Black Threat Hunter Team, recalls, "The first signs of activity we observed on the machine likely stemmed from lateral movement originating from a previously compromised device." By that point the attacker was already running two implants on the host machine, both with system privileges. One was designed to look like Adobe software, and the other OneDrive. For the sake of persistence, the former was registered as a scheduled task set to run every five minutes.
The initial bricklaying phase of the campaign concluded a month later. On Nov. 12, 2025, the attacker or attackers set up a command-and-control (C2) channel via Dropbox, so that their malicious exfiltrations might appear like legitimate network traffic. They registered a new scheduled task for running batch files, branded as an ordinary Lenovo system health check — the Lenovo bit demonstrating an intimate knowledge of their target's machine — and then deployed a custom infostealer.
... continue reading