HOLLOWGRAPH Malware Turns Microsoft 365 Calendar Events Into Covert Command-and-Control Channels

HOLLOWGRAPH, a Windows malware implant that transforms Microsoft 365 calendar events into a covert command-and-control channel.

This malware, which is highly likely linked to the Cavern modular backdoor framework, utilizes the Microsoft Graph API to retrieve tasks from operators and to exfiltrate stolen data via a compromised Microsoft 365 mailbox.

This technique enables malicious communications to blend in with legitimate Microsoft cloud traffic, making detection by conventional network security measures more challenging.

HOLLOWGRAPH Malware

HOLLOWGRAPH is a .NET NativeAOT-compiled DLL built around two primary commands: “get” and “send.” Instead of communicating directly with attacker-controlled web infrastructure, the implant uses the calendar from a compromised mailbox as a two-way dead drop.

Operators insert encrypted commands as attachments to calendar events. At the same time, infected endpoints create separate events containing encrypted files collected from victims.

All these events are scheduled for May 13, 2050, likely an effort to keep the activity hidden from the mailbox owner’s immediate calendar view.

To retrieve commands, the “get” function queries the Microsoft Graph calendarView endpoint for events within a tightly defined time window on the 2050 date.

It searches for event subjects that contain an identifier formatted as “Event ID: <taskID>”, downloads attachments named “File{n}.txt,” and decrypts their contents before sending the tasking back to the malware loader.

The loader invokes the implant using a structured parameter format of “<command>_;;_<arg0>_,_<arg1>_,_<arg2>”, which matches the command syntax of the Cavern framework.

The “send” command performs the reverse function. HOLLOWGRAPH encrypts files provided by its loader, creates a distant calendar event via Microsoft Graph, uploads the encrypted files as one or more attachments, and renames the event using a Boss{…}ID{…} convention recognizable to operators.

The malware employs hybrid cryptography for both communication directions: RSA-OAEP wraps a newly generated AES key, while AES-256-GCM encrypts the actual payload. Separate RSA key pairs protect incoming tasking and outgoing exfiltration, ensuring that the compromise of one communication direction does not automatically expose the other.

A second covert channel supports credential renewal. HOLLOWGRAPH uses DNS tunneling via IPv6 AAAA record lookups against cloudlanecdn[.]com to retrieve updated Microsoft Entra ID credentials, including tenant ID, client ID, client secret, and target mailbox.

Data is encoded into specially crafted subdomains, while DNS responses supply credential fragments. The implant reconstructs the data and writes the updated settings to logAzure.txt, a local configuration file disguised as a benign log.

Group-IB identified at least 12 systems carrying HOLLOWGRAPH. However, only about three were actively communicating with operator infrastructure during the observation period.

The earliest noted activity dates to June 3, 2026, with the most recent on July 9. Evidence includes a compromised mailbox linked to Israel and malware uploads originating from Israel, suggesting that the campaign targets Israeli organizations in a focused espionage operation.

The researchers conclude that HOLLOWGRAPH is part of the Cavern framework, citing the matching command structure and recovered tasking associated with the framework’s self-command codes.

Group-IB also noted similarities between Cavern and tools linked to Lyceum, an Iranian-associated subgroup tied to OilRig. However, it rated any link to Lyceum as low confidence and has not attributed the campaign to a known threat actor.

Organizations are advised to review Microsoft 365 audit logs for any unusual Graph API activity involving calendar creation, attachment uploads, and far-future events.

Security teams should investigate anomalous AAAA DNS queries, particularly repeated high-entropy subdomains targeting unfamiliar domains, and immediately revoke or rotate exposed Entra ID application credentials.

IOCs:

Network:

• Cloudlanecdn[.]com

Hashes:

• 75e51774b8f79e5f256eaae639635f911b3e744d4774fd6068dd980255621509
• F3f3006f8304788251b153d53b305322b8acab0c66ec816b8d9f101bcc851da3
• B3d0f6e4e3be395fd7cf9e8101c89963d77216578cbb117a6ac9bc3564485eff

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.