Threats Tagged 'sharpdecryptpwd'

An unknown attacker conducted a five-month espionage campaign targeting a senior executive at a major global stock exchange. The attackers incrementally stole the victim's Outlook mailbox data by extracting OST files in date-range windows, starting from historical emails and continuing regularly. They used legitimate cloud services such as Dropbox and OneDrive Personal for data exfiltration and command-and-control, helping them evade detection. Persistence was maintained through masquerading binaries and scheduled tasks mimicking legitimate Adobe and Lenovo services. The campaign demonstrated sophisticated operational discipline and focused on building a comprehensive intelligence picture of the executive's communications and organizational activities.