Hackers Use Future-Dated Outlook Events for Covert Command-and-Control
A new malware component, AzureCommunication.dll, linked to the Project CAV3RN framework, is using Microsoft Outlook calendar events dated 2050 for command-and-control (C2) and fallback credential recovery.
A sophisticated cyberespionage campaign is leveraging a novel technique to mask command-and-control (C2) traffic by embedding malicious instructions within Microsoft Outlook calendar events set for the distant future, specifically May 13, 2050. This new malware component, identified as AzureCommunication.dll and associated with the Project CAV3RN framework, replaces earlier C2 modules and utilizes a compromised Microsoft 365 mailbox to establish a covert communication channel.
The malware gains access to the target mailbox through the Microsoft Graph API, authenticating using OAuth 2.0 application credentials. By storing commands and operational data within calendar events scheduled decades in advance, threat actors significantly reduce the likelihood of detection by system administrators or automated security tools that typically scan current or near-future events. This tactic effectively turns the Outlook calendar into a dead-drop system for exchanging encrypted data.
Commands are delivered via calendar events with a specific subject format, Event ID: <agent-id>. The malware downloads the encrypted payload from an attachment, decrypts it using a hybrid encryption scheme (RSA-encrypted AES key protecting an AES-256-GCM payload), and then deletes the event. For exfiltration, results are uploaded in attachments to newly created calendar events, with subjects like Boss Report ID: <agent-id1500, and heartbeat events labeled Boss update ID: <agent-id1500 are used to monitor active implants.
Kaspersky researchers, who identified this activity, have linked it to highly targeted cyberespionage operations against Israeli organizations. While the broader CAV3RN ecosystem has been associated with Iran-nexus activity, the specific attribution of this campaign to actors like OilRig remains under assessment with low confidence.
As a fallback mechanism, the malware employs DNS AAAA records to recover compromised Microsoft Graph API credentials when cloud authentication fails. It queries actor-controlled DNS infrastructure, treating IPv6 addresses as containers for configuration fragments rather than network destinations. This allows attackers to retrieve updated tenant IDs, client IDs, client secrets, and target mailbox addresses, enabling them to repair their C2 configuration without deploying new malware payloads.
This sophisticated approach highlights the evolving tactics of advanced persistent threats (APTs), which increasingly seek to blend malicious activity with legitimate enterprise traffic by abusing trusted SaaS platforms. The use of future-dated calendar events and DNS tunneling for credential recovery demonstrates a high degree of technical proficiency and a focus on stealth.
Defenders are advised to scrutinize unusual Microsoft Graph calendar activity, particularly service principals creating or modifying events with future dates and suspicious subject lines. Monitoring Microsoft 365 audit logs for these anomalies, as well as DNS AAAA queries to suspicious domains containing long hexadecimal strings, can aid in detecting this campaign. The campaign underscores the need for organizations to maintain robust monitoring of cloud service usage and to be vigilant against novel C2 techniques.
This new report from Group-IB details the malware, dubbed HollowGraph, which is believed to be part of a larger toolkit and potentially linked to the Iran-nexus threat actor Cavern Manticore. HollowGraph specifically abuses Microsoft 365 calendars for C&C, using future-dated events to hide its communications and employing hybrid RSA + AES encryption for payloads.