An unattributed threat actor maintained persistent access to a senior finance executive’s email account at a global stock exchange for several months, using only native Windows tools to evade detection. The intrusion exploited weak authentication and misconfigured access controls; no custom malware or known CVE was involved. The business risk is severe: executive email at a stock exchange may contain material non-public information, creating direct exposure to insider trading liability, market manipulation, and regulatory sanction.