IC Technology & Cyber — 2026-07-21

HOLLOWGRAPH Espionage Malware Uses Microsoft 365 Calendar Events as Covert Command Channel

BLUFHOLLOWGRAPH's abuse of legitimate Microsoft 365 Graph API traffic for command and control very likely sustains targeting of Israeli-linked organizations through the remainder of 2026, rendering conventional network monitoring ineffective.

Group-IB researchers identified a new espionage implant, HOLLOWGRAPH, that abuses the Microsoft Graph API to turn a compromised Microsoft 365 mailbox calendar into a two-way command-and-control channel, supporting only two commands, "get" and "send", executed exclusively through trusted Microsoft cloud infrastructure 1. Operators plant tasking as calendar events and the malware exfiltrates stolen files as encrypted attachments on events dated to 13 May 2050 to avoid drawing the mailbox owner's attention, with Graph traffic secured by hybrid RSA and AES-256-GCM encryption using separate key pairs per direction 1. The malware's configuration is stored as a file named logAzure.txt disguised as a routine log, holding the Microsoft Entra ID tenant ID, application client ID and secret, target mailbox address, C2 domain, and two RSA keys 1. A secondary channel uses DNS tunneling via IPv6 AAAA queries against the domain cloudlanecdn[.]com to refresh Microsoft Entra ID credentials 1. Group-IB attributes the malware with high confidence to the Cavern backdoor framework, a judgment that reflects identification of 12 infected systems with roughly three actively communicating with attackers between 3 June and 9 July, and linked recovered indicators, including an Israeli compromised mailbox and malware samples uploaded from Israel, to a targeted interest in Israeli entities 1. The Hacker News and BleepingComputer reported the findings, both crediting Group-IB as the source 23.

Analysis
Group-IB's disclosure, resting solely on its own technical findings and republished without independent corroboration, forces defenders off signature-based DNS and IOC blocklists onto Graph API behavioral auditing, since HOLLOWGRAPH's traffic rides legitimate Microsoft 365 calls that standard network monitoring waves through. Organizations with Israeli operations or partnerships very likely face continued targeting through the remainder of 2026, given the operation's demonstrated selectivity, three of twelve infections actively tasked rather than opportunistic spray, though the low infection count may instead reflect a still-developing capability rather than mature targeting discipline. That ambiguity leaves security teams protecting Israeli-linked entities weighing whether to fund Graph API behavioral monitoring now or wait for confirmed exploitation against their own tenants.
4 sources
  1. HOLLOWGRAPH: Turning Microsoft 365 Calendars into Covert Command-and-Control Channels - Group-IB
  2. HollowGraph Malware Hides C2 and Stolen Files in Microsoft 365 Events Dated 2050 - The Hacker News
  3. New HollowGraph malware uses Microsoft Graph for stealthy C2 comms - BleepingComputer
  4. Microsoft 365 calendars become spy drop boxes in HOLLOWGRAPH campaign - The Register

View in full brief →

UNCLASSIFIED // OPEN SOURCE