HOLLOWGRAPH Malware Hijacks Microsoft 365 Calendars for Espionage

In the rapidly evolving landscape of cyber-espionage, state-sponsored threat actors are constantly refining their tactics to evade traditional network-security barriers and endpoint detection systems. The latest and perhaps most creative iteration of this trend is the newly discovered HOLLOWGRAPH malware, a sophisticated Windows-based implant identified by security researchers at Group-IB. Unlike conventional malware variants that rely on easily blocked, attacker-controlled servers, this implant utilizes the legitimate Microsoft Graph API to convert Microsoft 365 calendar invitations into a highly resilient, two-way command-and-control (C2) channel and an interactive exfiltration dead drop. By utilizing legitimate cloud infrastructure, the malware blends its malicious traffic into ordinary enterprise communications, rendering conventional domain-blocking and IP-filtering tools completely ineffective.

The implant itself is a .NET NativeAOT-compiled DLL. This compile-to-native execution model represents a notable shift in malware development; by compiling the assembly directly to machine-specific code, the developers have stripped away the typical Intermediate Language (IL) metadata, complicating standard reverse-engineering and static-analysis pipelines. Group-IB’s deep analysis revealed that the malware’s operations depend entirely on abusing the Microsoft Graph API through a compromised Microsoft 365 account. Because the traffic is directed entirely to trusted Microsoft endpoints (such as graph.microsoft.com), the C2 activity remains indistinguishable from routine enterprise operations unless scrutinized at the behavioral level.

How the HOLLOWGRAPH Malware Abuses Microsoft 365 Calendars

The core innovation of the HOLLOWGRAPH malware lies in its two-way “dead drop” communications strategy. Rather than reaching out directly to an external server to download secondary payloads or execute interactive shell sessions, the implant relies on a compromised mailbox’s calendar to host all transaction data. The implant’s API-focused design relies on two foundational commands: get and send.

The Mechanics of the GET Command

To pull instruction sets from the attacker, the HOLLOWGRAPH implant executes its get routine. Under the hood, the malware queries the Microsoft Graph API’s calendarView endpoint, scanning a highly specific calendar window for events that match its tactical parameters. The operators plant tasking payloads directly into the compromised calendar as event attachments. To identify these specific events, the malware searches for event subject lines formatted with a unique prefix, specifically Event ID: <7-char-taskID>. Once a matching event is identified, the implant retrieves the encrypted files attached to it—customarily named File{n}.txt—and downloads them directly to the local host. Once downloaded, the implant utilizes a localized private RSA key to decrypt the payload, passing the decrypted parameters back to the malware loader. This loader then invokes the payload using a highly structured command syntax: <command>_;;_<arg0>_,_<arg1>_,_<arg2>.

The Mechanics of the SEND Command

For data exfiltration, the malware executes its send routine. Instead of pushing compressed archives to an external FTP or cloud storage bucket, HOLLOWGRAPH encrypts the target files using a hybrid cryptographic scheme. It then generates a new calendar appointment via the Microsoft Graph API. The encrypted data is split into manageable chunks, and each chunk is uploaded as an attachment disguised as a plain text file (such as File{n}.txt). After the upload is complete, the malware renames the calendar event to a specific naming convention—such as Boss{..}ID{..}—to alert the monitoring operators that the exfiltration package is ready for extraction. This unique structure allows threat actors to move sensitive files in small, fragmented bursts without generating suspicious outbound network connections.

The May 13, 2050 Rendezvous: Tactical Invisibility

A primary concern for any threat actor using mailbox abuse is the risk of the victim or an IT administrator discovering the malicious activity. If a compromised user opens their Outlook calendar and notices unfamiliar appointments with strange attachments, the operation is instantly compromised. To resolve this operational risk, the developers of HOLLOWGRAPH implemented a brilliant, albeit simple, evasive technique: scheduling all malicious calendar appointments far in the future.

Specifically, the threat group schedules every malicious calendar event to occur on May 13, 2050. In typical enterprise environments, regular employees and IT administrative teams rarely scroll their digital calendars decades into the future. By placing their virtual dead drops on this exact future date, the threat actors ensure that the malicious appointments are effectively invisible during day-to-day business operations, remaining hidden unless an administrator runs a targeted query across the entire mail store.

Cryptographic Independence and the logAzure.txt Configuration

Despite the functional simplicity of its two-command architecture, HOLLOWGRAPH possesses a highly robust cryptographic design. The malware maintains its configuration locally on the compromised endpoint in a file named logAzure.txt, designed to blend in as a generic application log. This file contains the essential credentials and public/private key pairs required to maintain Graph API connectivity and secure data transactions.

The configuration file typically stores several vital operational parameters:

• The Microsoft Entra ID (formerly Azure AD) Tenant ID.
• The Application (Client) ID and Client Secret utilized for client-credential authentication.
• The target mailbox address assigned as the dead drop.
• The designated C2 domain utilized for fallback and update procedures.
• Two distinct, asymmetric RSA keys used to secure incoming and outgoing data.

To encrypt payloads, HOLLOWGRAPH utilizes a hybrid encryption mechanism combining AES-256-GCM and RSA. The use of separate RSA key pairs for incoming tasking and outgoing exfiltration is a critical defensive counter-measure. This operational division ensures cryptographic independence: if a security analyst recovers the public key used for data exfiltration, they still cannot decrypt the incoming instructions sent by the malware operators, keeping the attacker’s command pipeline secure.

Credential Refreshment via DNS Tunneling

While the calendar-based C2 channel is exceptionally stealthy, it relies on static client-credential secrets that can expire or be rotated by corporate IT administrators. If the connection details stored in logAzure.txt become invalid, the malware would lose its access to the Microsoft Graph API, effectively killing the C2 loop. To solve this, the authors of HOLLOWGRAPH engineered an out-of-band credential-refresh channel utilizing DNS tunneling.

Unlike traditional DNS tunneling, which is often used as a primary, high-bandwidth channel for data transfer, HOLLOWGRAPH uses this technique strictly as a lightweight fallback channel to retrieve updated Entra ID credentials. It executes this by abusing standard IPv6 address record lookups:

1. The malware initiates a standard DNS lookup for a sub-domain under an attacker-controlled domain, such as cloudlanecdn[.]com.
2. The request is routed through the standard corporate recursive DNS resolver to the attacker’s authoritative DNS server.
3. Rather than returning a standard IP routing address, the authoritative server responds with an IPv6 AAAA record.
4. The 128-bit IPv6 address returned by the server is actually a series of encoded hex segments containing the updated Tenant ID, Client ID, Client Secret, and target mailbox credentials.
5. The malware intercepts the AAAA response, decodes the hexadecimal payload back into its plaintext parameters, and writes the updated configurations directly into the logAzure.txt file on the host disk.

Because these DNS queries run in the clear and utilize standard protocol queries, they seamlessly bypass network perimeter firewalls that are not configured to analyze the high-entropy payload of IPv6 address lookups.

Attribution: The Cavern Framework and the Iranian Nexus

According to Group-IB’s Threat Intelligence team, HOLLOWGRAPH has been linked with high confidence to the modular Cavern backdoor framework. The Cavern framework is a highly adaptable, plugin-based toolkit designed for post-compromise espionage. Historically, the technical overlaps in command parsing, folder structures, and internal code modules link this framework to Iranian-nexus cyber-espionage threat actors, specifically Lyceum (also known as Cavern Manticore).

While Group-IB maintains a low-confidence attribution to Lyceum specifically, researchers highlight that the target profiles of the active HOLLOWGRAPH campaign are highly aligned with known Iranian state intelligence priorities. To date, Group-IB has identified 12 compromised endpoints associated with this campaign, with three actively communicating with the C2 infrastructure. Significantly, all target indicators, compromised mailboxes, and malware upload locations are traceably linked to organizations within Israel. The highly localized and narrow footprint of this activity confirms that HOLLOWGRAPH is an active, targeted espionage operation rather than an opportunistic malware outbreak. The oldest recorded communication dates back to June 3, 2026, with active operations identified as recently as July 9, 2026, indicating that this campaign has run undetected for weeks.

Detection, Hunting, and Enterprise Defenses

Because HOLLOWGRAPH conducts its operations through legitimate, encrypted Microsoft Graph API endpoints, conventional endpoint protection (EPP) and network-perimeter firewalls struggle to detect the infection. To defend against this threat, security teams must deploy a combination of behavioral logging, active calendar auditing, and anomalous DNS monitoring.

Defensive and threat hunting teams should focus on the following core activities:

• Hunt for Far-Future Calendar Events: Organizations should regularly run automated scripts (such as Exchange PowerShell queries) across all corporate mailboxes to search for any calendar appointments scheduled in the far future, specifically filtering for the date May 13, 2050, or scanning for events containing file attachments in non-standard dates.
• Audit Microsoft Graph API Permissions: Strictly monitor and audit Microsoft Entra ID application registrations and permissions. Watch for non-standard application roles assigned to mailbox access, particularly delegated or application permissions allowing mailboxes to write, create, or read calendar events (e.g., Calendars.ReadWrite).
• Monitor for logAzure.txt: Set Endpoint Detection and Response (EDR) rules to flag or block the creation of files named logAzure.txt in user profile directories or application data paths.
• Analyze IPv6 DNS Lookups: Monitor recursive DNS logs for high-frequency or anomalous IPv6 AAAA record lookups directed at unfamiliar external domains, especially domains containing dynamic prefix patterns or those linked to indicators of compromise, such as cloudlanecdn[.]com.

The discovery of the HOLLOWGRAPH malware represents a significant milestone in modern cyber-espionage. By exploiting trusted SaaS applications and utilizing creative temporal placement, threat actors are continuously proving that the cloud is no longer just a target, but a powerful weapon in their operational arsenals.