HollowGraph Malware Abuses Microsoft 365 Calendars for Covert C2
A new malware strain, HollowGraph, has been discovered weaponizing Microsoft 365 calendars and Graph APIs to establish covert command and control channels, evading traditional detection methods.
A sophisticated new malware, dubbed HollowGraph, has emerged, employing a novel technique to establish covert command and control (C2) communications by abusing Microsoft 365 calendars and the Microsoft Graph API. Researchers at Group-IB have attributed this highly targeted malware with high confidence to the Cavern backdoor framework, indicating a connection to a known and evolving threat landscape.
The HollowGraph attack appears to be highly targeted, with initial analysis revealing that the compromised mailbox and uploaded malware samples were associated with an Israeli organization. This focused approach suggests the operation is not opportunistic but rather a deliberate campaign aimed at specific entities. The earliest observed communication between a victim and the attacker occurred on June 3, 2026, with the most recent example identified on July 9, affecting a total of 12 systems.
While a definitive attribution to a specific threat actor remains elusive, Group-IB researchers noted several technical similarities with the Iranian-nexus threat actor Lyceum, particularly concerning espionage activities. The combination of advanced malware capabilities and disciplined, narrowly scoped targeting points towards a well-resourced and capable adversary.
HollowGraph's primary innovation lies in its method of evading detection. Instead of communicating directly with attacker-controlled servers, it leverages trusted Microsoft services. The malware supports two core commands: 'get' and 'send.' The 'send' command facilitates the exfiltration of encrypted stolen files by creating calendar appointments with these files attached. Conversely, the 'get' command enables the retrieval of operator-planted instructions by searching for and downloading attachments from specific calendar appointments.
To maintain its C2 channel, HollowGraph employs DNS tunneling to deliver and refresh Microsoft Entra ID (Azure AD) credentials necessary for authenticating to the Graph API. While the Graph channel itself is not encrypted, the communications are secured using a hybrid encryption scheme combining RSA and AES-256-GCM. Notably, distinct RSA key pairs are utilized for inbound and outbound traffic, adding another layer of obfuscation.
The connection to the broader Cavern framework is evidenced by several technical characteristics. The command format used by HollowGraph, such as <command>_;;_<arg0>_,_<arg1>_,_<arg2>, directly mirrors Cavern's syntax. Furthermore, observed commands, like the 'Toggle debug logging' instruction classified as an agent self-command, align with Cavern's operational structure. The observed tasking from the C2 server also mirrors Cavern's format, leading Group-IB to assess that HollowGraph represents a distinct variant within the Cavern framework.
To defend against this emerging threat, cybersecurity professionals are advised to continuously hunt for indicators associated with HollowGraph. Monitoring Microsoft Graph API activity and Microsoft 365 mailbox audits for anomalous calendar operations—such as event creation, attachment uploads, or subject changes initiated by applications rather than users—is crucial for early detection.
This new reporting from The Register details how the HOLLOWGRAPH malware campaign specifically abuses Microsoft 365 calendars for command-and-control, stashing instructions and stolen files in future-dated appointments. The malware leverages legitimate Microsoft Graph API requests to blend in, making its C2 traffic indistinguishable from normal cloud activity, and uses DNS tunneling to refresh Entra ID credentials. The campaign appears narrowly targeted, with observed activity linked to an Israeli organization.
This new report from The Hacker News provides further technical details on the HollowGraph malware, including its use of a secondary, cruder channel for maintaining Entra ID (Azure AD) login details via DNS AAAA records pointing to cloudlanecdn[.]com. It also highlights the malware's hybrid RSA and AES-256 encryption for data transmitted via the calendar channel and notes that Group-IB attributes the malware with high confidence to the Cavern framework, which overlaps with Iranian actors like MuddyWater and Lyceum, though a definitive actor attribution remains elusive.
The new analysis reveals that HollowGraph utilizes a secondary, unencrypted communication channel via DNS tunneling to obtain updated Microsoft Entra ID credentials. This allows the malware to refresh its access to Microsoft Graph, ensuring continued stealthy command-and-control operations even if initial credentials are compromised or rotated.
The HOLLOWGRAPH malware employs a secondary covert channel for credential refresh, utilizing DNS tunneling via IPv6 AAAA record queries to the domain "cloudlanecdn[.]com". This allows the malware to quietly update its Microsoft Entra ID (Azure AD) login credentials, storing them in a file disguised as a log file named logAzure.txt. Group-IB's analysis also notes technical overlaps with the Lyceum threat group, an Iranian actor linked to the Ministry of Intelligence and Security, though this connection is considered low confidence.
This new reporting provides further technical details on the HOLLOWGRAPH malware, including its specific command-and-control mechanism using Microsoft Graph API and calendar events dated far into the future (May 13, 2050) to store commands and exfiltrated data. It also details the use of DNS tunneling for credential renewal and highlights a potential, though low-confidence, link to the Iranian-nexus threat actor Lyceum.