Hackers accessed senior exec email at global stock exchange

A sophisticated hacking campaign gave attackers access to the email inbox of a senior executive at a major global stock exchange for approximately five months, from October 2025 to March 2026. Researchers from Broadcom’s Symantec, in collaboration with Carbon Black’s Threat Hunter Team, investigated the incident, describing it as a meticulously planned espionage operation focused on stealing the complete contents of a single Outlook mailbox.

The attackers maintained persistent access to the executive’s email for roughly 150 days, siphoning data in small, incremental batches to avoid detection. Their objective appeared to be intelligence gathering rather than financial theft, leveraging the high-value information typically found in such an inbox. Analysts noted this could include non-public details on upcoming listings, regulatory enforcement actions, internal corporate deliberations, and the executive's calendar and contacts, providing a comprehensive view of the organization’s near-term direction without requiring broader network access.

The first observed malicious activity occurred on October 10, 2025, by which time two malicious binaries were already running on the victim's...