HollowGraph Malware Exploits Microsoft 365 Events to Conceal C2 Communications and Stolen Data

Key Findings

• HollowGraph malware uses hijacked Microsoft 365 calendar events dated 2050 as a command-and-control channel, disguising malicious traffic as legitimate Microsoft Graph API activity

• The .NET implant supports only two commands (get and send) and never connects to attacker-owned servers, instead treating a compromised mailbox calendar as a two-way dead drop

• Tasking and exfiltrated files are encrypted with hybrid RSA-OAEP and AES-256-GCM encryption, with separate key pairs for incoming and outgoing data

• A secondary DNS channel over IPv6 AAAA records refreshes Entra ID credentials in plaintext, stored in a file disguised as a log

• Group-IB links HollowGraph to the Cavern backdoor framework with high confidence but attributes the campaign to an unidentified threat actor with only low-confidence possible ties to Iranian-nexus group Lyceum

• At least 12 infected systems were identified, with approximately three actively communicating between June and July 2026, suggesting targeted espionage against an Israeli organization

• No Microsoft vulnerability or patch exists; the attack relies on compromised credentials and legitimate API functionality

Background

Group-IB researchers discovered HollowGraph, a new espionage implant that operates entirely through trusted Microsoft cloud infrastructure. The malware represents an evolution in command-and-control evasion tactics, leveraging legitimate services to avoid detection by network security controls. The implant is a .NET DLL compiled with NativeAOT, keeping it lightweight and functional without reaching out to traditional attacker infrastructure.

Calendar Dead Drop Infrastructure

The core innovation behind HollowGraph is its use of a compromised mailbox's calendar as a two-way communications channel. Rather than querying external command servers, the implant reads operator instructions from calendar events buried at a far-future date: May 13, 2050. This date selection is deliberate, placing tasking where a legitimate mailbox user would never scroll while reviewing their schedule. Operators plant instructions as file attachments with standardized naming like File1.txt, File2.txt, and so on. The implant retrieves these attachments, decrypts them, and executes the embedded commands. To exfiltrate stolen data, HollowGraph reverses the process: it encrypts target files, creates its own calendar event dated to 2050, and uploads the data as attachments. All calendar traffic moves through the Microsoft Graph API, appearing indistinguishable from normal Microsoft 365 activity.

Encryption and Command Structure

Every payload traversing the calendar channel receives dual-layer protection using RSA-OAEP for key exchange and AES-256-GCM for symmetric encryption. The malware employs separate RSA key pairs for tasking and exfiltration, ensuring cryptographic independence between incoming commands and outgoing data. This architecture prevents a compromised key from exposing both directions of communication. Tasking follows a structured format with seven-character identifiers that label each exchange. The get command instructs the implant to pull and decrypt operator instructions. The send command tells it to encrypt a specified file and upload it as an attachment to a newly created calendar event.

Credential Refresh Through DNS

A secondary command channel handles credential renewal using an unencrypted DNS tunneling technique. The implant periodically queries an attacker-controlled domain, cloudlanecdn[.]com, requesting IPv6 AAAA records. The attacker encodes Entra ID credentials within these DNS responses, including tenant ID, client ID, and client secret. HollowGraph decodes these values and writes them to a file named logAzure.txt, which masquerades as a routine system log. This DNS channel operates in plaintext, making it the implant's most conspicuous element, though it still blends with normal network traffic. Unlike the calendar channel which uses application-generated access tokens, this channel stores and refreshes client credentials directly, requiring no interactive authentication from the attacker.

Attribution and Threat Actor Assessment

Group-IB attributes HollowGraph to the Cavern framework with high confidence based on matching command syntax and identical internal tasking code structures. However, the specific threat actor remains unidentified. Researchers observed low-confidence overlaps with Lyceum, an Iranian-nexus group classified as a subgroup of the larger OilRig cluster. Check Point previously linked Cavern to an Iranian Ministry of Intelligence and Security actor it calls Cavern Manticore. Group-IB explicitly notes that current evidence does not support confident attribution to any previously identified threat actor, treating the Israeli victim geography as targeting rather than attribution evidence.

Campaign Scope and Targeting

Researchers identified at least 12 systems infected with HollowGraph, though only approximately three maintained active communication with attacker infrastructure during the analysis window. Victim traffic occurred between June 3 and July 9, 2026, with the most recent contact observed on July 9. This narrow temporal window and selective system footprint indicate targeted espionage rather than opportunistic criminal activity. The compromised mailbox belonged to an Israeli organization, the sole victim identified during the investigation. The limited deployment suggests operators carefully selected targets rather than conducting widespread campaigns.

Detection and Hunting Guidance

Defenders should focus on identity and application permissions rather than network perimeter controls, since HollowGraph traffic appears legitimate to standard security monitoring. Calendar events with far-future dates, specifically May 13, 2050, represent the sharpest detection signal. Events with suspicious characteristics include bare GUID subjects, patterns matching "Event ID:" or "Boss{..}ID{..}" naming conventions, and attachments named File{n}.txt. On the identity side, teams should restrict and audit client-credential OAuth applications accessing Microsoft Graph, alert on newly created client secrets, and maintain standard Entra ID hygiene including Conditional Access policies, credential rotation, and anomalous token detection. For DNS hunting, monitor for unusually frequent AAAA queries and long, high-entropy subdomains targeting single external domains. The fast first pass includes hunting for cloudlanecdn[.]com references and the logAzure.txt configuration file.

Why This Approach Remains Difficult to Detect

HollowGraph exploits the fundamental trust enterprises place in Microsoft services. No Microsoft vulnerability exists, so patching provides no defense. The malware rides on compromised credentials and leverages normal Graph API functionality designed for legitimate business purposes. Network controls tuned to flag suspicious external connections see only ordinary Microsoft 365 traffic. The use of a far-future calendar date, while creative, works because security monitoring tools rarely inspect calendar events for malicious content. Previous campaigns have similarly hidden in Outlook inboxes, draft folders, and OneDrive, yet this calendar approach adds a new variation to an established evasion pattern. Until defenders begin treating cloud calendar and event systems as potential security blindspots worthy of active monitoring, techniques like this will continue to provide reliable cover for targeted espionage operations.

Sources

• https://thehackernews.com/2026/07/hollowgraph-malware-hides-c2-and-stolen.html

• https://securityonline.info/hollowgraph-malware-microsoft-graph-api/