HollowGraph hides C2 in Microsoft 365 calendars

A malware component dubbed HollowGraph is using the calendar inside compromised Microsoft 365 mailboxes as a stealthy command-and-control channel, according to a report from Group-IB. The researchers say the malware receives attacker instructions and exfiltrates stolen data through calendar events, and they believe it is part of the Cavern command-and-control framework previously linked to an Iranian threat actor targeting entities in Israel.

Group-IB says at least 12 systems were infected with HollowGraph, with three actively communicating with the threat actor between June 3 and July 9. Based on the indicators collected, the researchers say the campaign appears focused on organizations in Israel, suggesting a targeted espionage operation.

The malware authenticates to the Microsoft Graph API using hardcoded details tied to a compromised Microsoft 365 account. Its configuration is stored in a file named logAzure.txt and includes the Microsoft Entra ID tenant ID, application (client) ID, client secret, target mailbox address, C2 domain, and two RSA keys. Those keys are used to encrypt stolen files sent to the attacker and decrypt incoming tasks.

To stay hidden, the operator creates calendar events dated May 13, 2050. Commands and stolen data are concealed in files attached to those entries. Group-IB says HollowGraph supports just two commands:

• GET: searches for entries in the format “Event ID: <7-char-taskID>”, then downloads and decrypts instructions
• SEND: creates a calendar entry in the format “Boss{..}ID{..}” and attaches stolen data encrypted with the public RSA key

The researchers describe the mailbox calendar as a “covert dead-drop”, with HollowGraph checking for instructions in a fixed one-hour window between 22:00 and 23:00 UTC on May 13, 2050. Group-IB says the malware uses a hybrid encryption scheme combining RSA and AES-256-GCM, keeping inbound and outbound communications cryptographically separated.

Recommended reading

Spy malware hides in Microsoft 365 calendars

×

HollowGraph’s operational overview

The malware also has a second, unencrypted channel over DNS tunneling. Group-IB says it uses IPv6 AAAA record queries to the attacker-controlled domain cloudlanecdn[.]com to fetch updated Microsoft Entra ID details, including tenantId, clientId, clientSecret, and mailbox, then writes them back to logAzure.txt.

“Each returned IPv6 address (16 bytes) yields 14 usable payload bytes.”

The malware rebuilds the payload from those 14-byte chunks, decodes it as UTF-8 text, and stores the result in the matching configuration field.

“HOLLOWGRAPH demonstrates a high level of technical sophistication. Its use of trusted cloud infrastructure for command-and-control, hybrid encryption, DNS tunneling for credential refresh, and highly selective victim targeting collectively suggest that the threat actor possesses significant technical capabilities and operational maturity.”

Group-IB says it cannot confidently attribute HollowGraph to a known threat actor, though it found technical similarities with the Iranian-nexus actor Lyceum. The firm says the evidence is not strong enough for high-confidence attribution there, but it assesses with high confidence that HollowGraph is linked to the Cavern framework.

The researchers recommend monitoring Microsoft Graph and Microsoft 365 audit logs for suspicious application-driven calendar activity, especially far-future events, unusual subjects, and suspicious attachments. They also advise watching for cloudlanecdn[.]com and logAzure.txt, enforcing Conditional Access, restricting and auditing OAuth client-credential applications, and monitoring outbound DNS for tunneling patterns.

×