HollowGraph Malware Hijacks Microsoft 365 Calendars for Espionage

As corporate environments increasingly shift their primary directory services, email systems, and operational workloads to cloud software-as-a-service (SaaS) platforms, advanced persistent threats (APTs) are rapidly adapting their tactics to exploit the inherent trust of these environments. A prime example of this cloud-focused evolution is the newly discovered HollowGraph malware, a highly sophisticated espionage tool that hijacks Microsoft 365 calendars to establish an invisible, two-way Command and Control (C2) channel. First identified by the threat intelligence firm Group-IB, this malware operates entirely within the boundaries of legitimate enterprise traffic, exposing critical blind spots in modern security information and event management (SIEM) systems.

Instead of communicating with standard, attacker-owned command-and-control servers—which are frequently flagged and blocked by automated firewalls and secure web gateways—HollowGraph uses the victim organization’s own compromised Microsoft 365 mailbox as a virtual dead drop. By setting calendar appointments for dates decades into the future, specifically May 13, 2050, the operators behind this campaign are able to pass instructions and exfiltrate highly sensitive data without ever triggering a desktop notification or raising the suspicions of the legitimate account holder.

The Evolution of “Living off the Cloud” via Microsoft Graph API

For years, cybersecurity professionals have warned about “living off the land” (LotL) tactics, wherein threat actors abuse native operating system tools to perform malicious activities. Today, we are witnessing the migration of this concept to cloud platforms—a strategy known as “living off the cloud” (LotC). HollowGraph represents a high-water mark for LotC, utilizing the robust Microsoft Graph API to carry out its operations.

The Microsoft Graph API is a unified programmability model that allows developers (and, unfortunately, threat actors) to access data across Microsoft 365, Windows, and Enterprise Mobility + Security. Because the API is core to normal enterprise operations, traffic directed at the Graph API endpoint (graph.microsoft.com) is typically whitelisted by default across all security boundaries. HollowGraph abuses this implicit trust. From the perspective of traditional network monitoring tools, the malware’s command-and-control requests are indistinguishable from routine Outlook syncs, Microsoft Teams notifications, or OneDrive file uploads.

By leveraging a compromised Microsoft 365 mailbox, the threat actors establish what researchers call a “two-way dead drop”. In espionage history, a dead drop is a physical location where spies pass secrets without directly meeting. In the digital context, the compromised calendar acts as this secure meeting ground. The malware never makes an outbound connection to an external malicious IP or domain for its operations, eliminating one of the most reliable telemetry sources that security operations centers (SOCs) rely on to detect breaches.

Technical Analysis: How the HollowGraph Malware Operates

At its core, HollowGraph is a lightweight, highly optimized Windows implant compiled as a .NET NativeAOT (Ahead-of-Time) DLL. This specific compilation choice is significant; NativeAOT compiles the C# codebase directly into machine-native code, stripping out much of the standard .NET metadata that reverse-engineers rely on to decompile binaries. This design choice drastically reduces the detection rates of the malware on endpoints, allowing it to bypass legacy antivirus engines with relative ease.

The HollowGraph malware is purposefully designed with a minimal footprint, supporting only two primary operations to carry out its espionage missions:

• The get Command (Tasking Retrieval): To receive new instructions, the malware queries the compromised Microsoft 365 mailbox’s calendar via the Graph API. It actively scans for calendar entries that follow a highly specific naming convention, looking for subject lines matching the format: Event ID: <7-character-taskID>. Once identified, the implant downloads the instructions, which are stored as an attachment within the calendar event, and decrypts them locally.
• The send Command (Data Exfiltration): When tasked with exfiltrating files from an infected endpoint, HollowGraph packages the target documents, encrypts them, and splits them into manageable chunks. It then connects to the Graph API, programmatically creates a new calendar event, and uploads these encrypted chunks as file attachments named File{n}.txt. To signal to the operators that the data is ready for collection, the malware renames the event subject line to a specific, operator-recognizable tag, such as Boss{..}ID{..}.

The Brilliance of the “May 13, 2050” Hiding Technique

One of the most remarkable aspects of the malware is its temporal evasion technique. If an attacker created standard calendar events for the current day, week, or even month, the victim would quickly notice unexpected entries popping up on their Outlook calendar. This would lead to immediate investigation and remediation.

To bypass this, HollowGraph schedules every single malicious calendar event for May 13, 2050. Because this date is nearly a quarter-century into the future, no typical user, corporate administrative assistant, or system administrator is going to scroll that far down their timeline in the normal course of business. The data sits quietly, isolated in a future-dated pocket of the cloud database, accessible only via API queries targeting that specific chronological window.

Cryptographic Isolation: Hybrid RSA and AES-256-GCM

The developers of HollowGraph left nothing to chance regarding data security. Even if an enterprise defender managed to audit the compromised calendar and locate the future-dated appointments, they would find themselves staring at unreadable, encrypted binary blobs.

The malware utilizes a highly robust hybrid cryptographic architecture combining AES-256-GCM symmetric encryption and RSA asymmetric encryption. What makes this implementation particularly sophisticated is its complete cryptographic isolation. HollowGraph uses two completely separate RSA key pairs: one designated for incoming tasking instructions (used by the get command) and another designated for outgoing stolen data (used by the send command).

This isolation ensures that even if a security team manages to extract the decryption key for outgoing exfiltrated files from the local malware sample, they will remain completely unable to decrypt the incoming tasking commands, and vice-versa. This design prevents defenders from gaining full visibility into the threat actor’s entire operations during an active incident response investigation.

The Out-of-Band Channel: DNS Tunneling for Credential Management

A major operational challenge for any cloud-based malware is credential expiry. If the credentials HollowGraph uses to authenticate to the Microsoft Graph API are revoked, expired, or rotated, the C2 channel would permanently collapse. To overcome this bottleneck, the threat actors built a secondary, out-of-band communication channel dedicated solely to keeping the malware’s credentials fresh.

This secondary channel relies on DNS tunneling via IPv6 AAAA record queries sent to an attacker-controlled domain, specifically cloudlanecdn[.]com. Because DNS is another protocol that must be allowed to leave the network for basic internet connectivity, it makes for an ideal secondary escape route.

To update the Microsoft Entra ID (formerly Azure AD) credentials required to access the compromised mailbox—including the tenant ID, application/client ID, client secret, and target mailbox address—the malware sends specialized DNS queries. The attacker-controlled nameserver responds with IPv6 addresses containing encoded payloads. HollowGraph reassembles these payloads from 14-byte chunks, decodes them as UTF-8 text, and updates its local configuration file.

To further blend in with normal local host operations, HollowGraph writes these updated details to a local configuration file named logAzure.txt. Designed to resemble an ordinary, administrative Azure log file, logAzure.txt acts as a local repository for the malware’s critical connection secrets, including the updated Entra ID configurations and the necessary RSA cryptographic keys.

Targeting Scope and the “Cavern” Attribution

Despite its immense technical sophistication, the campaign leveraging the HollowGraph malware has been characterized by highly disciplined, narrow scope targeting. Group-IB’s threat intelligence team identified only 12 infected systems across their global visibility, with only three actively communicating with the C2 channel during the main investigation period.

This extremely small victim footprint strongly indicates a targeted cyber-espionage campaign rather than an opportunistic malware spam run. The geographical and sector focus was heavily concentrated on organizations in Israel, with the compromised mailbox used in the main dead-drop infrastructure traced to an Israeli entity. Based on telemetry, the earliest victim-attacker communication dates back to June 3, 202