HollowGraph Malware Abuses Microsoft 365 Calendars for C2

The HollowGraph malware uses compromised Microsoft 365 mailboxes to communicate with attackers and send out stolen data.

Instead of relying on a conventional command-and-control server, the malware abuses the calendar feature in Microsoft 365. It creates and checks calendar events through the Microsoft Graph API, allowing attackers to hide commands and encrypted files inside what appears to be normal cloud activity.

Researchers at Group-IB identified at least 12 infected systems. Three of them communicated with the threat actor between 3 June and 9 July. The evidence suggests the campaign primarily targets organisations in Israel, possibly for espionage.

HollowGraph Malware Uses Calendar Events as a Dead Drop

HollowGraph authenticates to Microsoft Graph using credentials for a compromised Microsoft 365 account. Its configuration is stored in a file called logAzure.txt, which is designed to look like a harmless log file.

The file contains several important details, including the Microsoft Entra ID tenant ID, application client ID, client secret, target mailbox address, C2 domain, and two RSA keys.

The malware uses these keys to encrypt stolen files before uploading them. It also uses them to decrypt instructions sent by the attacker.

To avoid detection, HollowGraph creates calendar events dated 13 May 2050. Commands and stolen information are hidden in files attached to those events. The malware then checks a specific one-hour period, between 22:00 and 23:00 UTC, for new instructions.

HollowGraph supports two commands:

• GET searches for calendar events containing attacker instructions, then downloads and decrypts them.
• SEND creates a calendar event and attaches encrypted stolen data for the attacker to collect.

This technique turns a Microsoft 365 mailbox calendar into a covert dead-drop system.

DNS Tunnelling Delivers New Credentials

The HollowGraph malware also uses DNS tunnelling to receive updated Microsoft Entra ID credentials.

It queries IPv6 AAAA records for the attacker-controlled domain cloudlanecdn[.]com. Each response contains a small piece of data. HollowGraph combines these pieces, decodes them, and updates the details stored in logAzure.txt.

The refreshed configuration may include a new tenant ID, client ID, client secret, and mailbox address. This gives attackers a way to maintain access if existing Microsoft Graph credentials stop working.

Group-IB said the malware uses a hybrid encryption system based on RSA and AES-256-GCM. This protects files and commands sent through the Microsoft Graph channel.

Researchers See Links to the Cavern Framework

Researchers believe HollowGraph is connected to the Cavern command-and-control framework with high confidence.

They also found technical similarities with Lyceum, an Iranian-linked threat actor previously associated with attacks against organisations in Israel. However, the evidence is not strong enough to attribute the HollowGraph campaign to Lyceum with confidence.

The use of trusted cloud services, encrypted communications, DNS tunnelling, and selective targeting points to a technically capable threat actor.

How to Detect HollowGraph Malware

Organisations should review Microsoft 365 and Microsoft Graph audit logs for unusual calendar activity created by applications.

In particular, security teams should investigate calendar events scheduled far in the future, suspicious event subjects, and unexpected attachments. They should also monitor for the cloudlanecdn[.]com domain and the logAzure.txt file.

Restricting OAuth client-credential applications, enforcing Conditional Access policies, and monitoring outbound DNS traffic for tunnelling patterns can also help detect HollowGraph malware activity.