Hackers Hide Malware Commands in Microsoft 365 Calendar Events Dated 2050

A cyberespionage implant is using Microsoft 365 calendar events dated May 13, 2050, to receive commands and return stolen information through Microsoft Graph.

Group-IB named the malware HOLLOWGRAPH and connected it with high confidence to the modular Cavern backdoor framework. Its HOLLOWGRAPH investigation identified at least 12 infected systems, including approximately three that were actively communicating with attacker infrastructure.

Kaspersky independently analyzed the component as AzureCommunication.dll within Project CAV3RN. The company’s technical report found that the DLL uses Outlook calendar events for command-and-control communication and DNS AAAA responses to recover Microsoft Graph credentials.

How hackers use Outlook calendar events for C2

The malware authenticates to Microsoft Entra ID with an application client ID and client secret. It then accesses the default calendar of a compromised Microsoft 365 mailbox through Microsoft Graph.

Commands, heartbeat messages, and stolen results occupy the same fixed calendar window on May 13, 2050, from 22:00 to 23:00 UTC. Events scheduled decades into the future are unlikely to appear during ordinary calendar use.

The technique turns the mailbox into a two-way dead drop. Operators create events containing encrypted commands, while infected computers create separate events with encrypted results attached.

Calendar artifact	Purpose	Malware action
Event ID: <agent-id>	Operator command	Downloads attachments and deletes the event
Boss update ID: <agent-id>1500	Implant heartbeat	Deletes the previous heartbeat and creates a replacement
Boss Report ID: <agent-id>1500	Command results or stolen data	Creates an event and uploads encrypted attachments

AzureCommunication.dll replaces a conventional web channel

Project CAV3RN uses a controller-and-plugin architecture that separates command execution from network communication. Its controller maintains a seven-character agent identifier and sends tasks to additional modules.

An earlier component called n-HTCommp.dll communicated through HTTP and WebSocket connections. AzureCommunication.dll supports a similar interface but uses Microsoft Graph and calendar events instead.

Kaspersky assesses that the new module was designed to replace the earlier communication component. Researchers did not recover the corresponding updated controller, so they could not directly observe that replacement in operation.

• uxtheme.dll acts as the CAV3RN controller.
• AzureCommunication.dll handles Microsoft Graph communication.
• The module supports get and send operations.
• A seven-character agent ID identifies each infected system.
• The previous HTTP or WebSocket address remains in the interface but is ignored.

How the malware receives commands

For an incoming command, the malware searches the fixed 2050 calendar window for a subject containing Event ID: <agent-id>. It selects the first matching event and requests its attachments.

After retrieving the attachments, the implant deletes the event. This behavior reduces the time that operator-created tasking remains visible in the compromised mailbox.

The inbound data uses hybrid encryption. An RSA-protected AES key accompanies a payload encrypted and authenticated with AES-256-GCM.

1. The operator creates a calendar event dated May 13, 2050.
2. The event subject contains the targeted implant’s agent ID.
3. An encrypted command is added as an attachment.
4. The malware queries the calendar through Microsoft Graph.
5. It downloads and decrypts the attachment.
6. It deletes the command event after collection.

Stolen data returns through calendar attachments

When sending results, AzureCommunication.dll generates a new AES-256-GCM key and encrypts the command output. It protects that key with the configured RSA public key.

The implant divides the encrypted package into attachments of up to 10 MiB. It initially creates the calendar event with the temporary subject d, uploads attachments such as File0.txt, and then changes the subject.

The completed event uses Boss Report ID: <agent-id>1500. The fixed 1500 suffix is not part of the seven-character agent identifier.

Communication direction	Attachment pattern	Protection
Operator to implant	file0.txt	RSA-protected key and AES-256-GCM payload
Implant to operator	File0.txt, File1.txt, and later files	Separate RSA key direction and AES-256-GCM payload
Heartbeat	No attachment	Calendar event replacement

DNS AAAA records restore stolen Microsoft credentials

If OAuth token acquisition or Microsoft Graph tenant validation fails, the malware contacts the attacker-controlled domain cloudlanecdn[.]com through DNS AAAA queries.

The returned IPv6 addresses do not function as network destinations. Instead, AzureCommunication.dll treats their bytes as containers for replacement Microsoft Entra configuration data.

The recovery process can update the tenant ID, client ID, client secret, and target mailbox address. The malware saves the reconstructed configuration in a local file called logAzure.txt.

1. The malware converts its seven-character agent ID into hexadecimal.
2. It includes that identifier in DNS queries sent to the recovery domain.
3. An initial query obtains the length of each configuration value.
4. Additional AAAA responses return the value in fragments of up to 14 bytes.
5. The malware reconstructs and saves the replacement configuration.
6. It retries Microsoft Graph authentication with the new credentials.

This recovery design allows the operators to repair the cloud communication channel without replacing the malware on an infected computer. The DNS mechanism restores configuration rather than carrying the main commands and stolen output.

HOLLOWGRAPH targeted Israeli systems

Group-IB identified 12 systems carrying HOLLOWGRAPH, although only around three were actively communicating during its analysis. The company observed the earliest exchange on June 3, 2026, and the latest on July 9, 2026.

The compromised Microsoft 365 mailbox and related telemetry pointed to an interest in Israeli organizations. Group-IB described the activity as a focused espionage operation rather than widespread malware distribution.

The company’s malware analysis linked HOLLOWGRAPH to the Cavern framework with high confidence. However, it could not confidently attribute the campaign to a previously identified threat actor and assessed a possible Lyceum connection with low confidence.

OilRig attribution remains uncertain

Kaspersky has tracked Project CAV3RN since December 2025 and observed several changes to its architecture. The framework shifted toward a controller-based design with a more extensive plugin system in April 2026.

The researchers found similarities with previously documented OilRig operations. These included using Microsoft-hosted services, exchanging commands through attachments, and maintaining a secondary method for restoring cloud access.

However, the Project CAV3RN research found no direct code reuse or infrastructure overlap with OilRig. Kaspersky therefore retained only a low-confidence association with the Iran-linked group.

No Outlook vulnerability is required

The malware does not rely on a disclosed vulnerability in Outlook, Microsoft 365, Microsoft Graph, or Entra ID. It abuses valid API operations after obtaining application credentials and access to a compromised mailbox.

Because the resulting connections go to legitimate Microsoft services, traditional controls that focus only on known malicious domains may not identify the calendar traffic.

The attacker-controlled DNS domain remains externally visible, but the main C2 exchange can blend with other Microsoft Graph requests. This makes identity, application, mailbox, and audit monitoring particularly important.

What security teams should monitor

Defenders should investigate applications or service principals that create, modify, delete, or attach files to calendar events without a documented business purpose.

Microsoft explains that administrators can search recorded activities through the Microsoft 365 audit log in the Purview portal. Relevant investigations should correlate mailbox operations with application identities, times, affected objects, and source information.

Analysts should also search for events dated May 13, 2050, especially within the 22:00 to 23:00 UTC window. The known subject and attachment patterns provide more specific hunting clues.

• Calendar events scheduled for May 13, 2050
• Subjects beginning with Event ID:
• Subjects beginning with Boss update ID:
• Subjects beginning with Boss Report ID:
• Attachments named file0.txt or File0.txt
• Repeated event creation, modification, and deletion by an application
• Unexplained OAuth client-credential activity
• New or unexpected client secrets
• DNS AAAA queries for cloudlanecdn[.]com
• Long hexadecimal labels inside DNS query names

Administrators can use Microsoft’s audit activity reference to identify searchable operations across Microsoft 365 services. Organizations should confirm that they retain enough audit data for historical investigations.

Recommended defensive actions

Organizations should review all applications using client-credential authentication and remove unnecessary Microsoft Graph permissions. They should rotate exposed credentials and investigate unexplained access to mailbox calendars.

Security teams should route DNS traffic through controlled resolvers and alert on unusual AAAA query volume, long subdomains, and repeated requests to newly observed infrastructure.

If defenders find the known malware or calendar artifacts, they should isolate affected endpoints, revoke compromised application credentials, remove unauthorized service principals, invalidate active tokens, and examine the associated mailbox for additional events.

1. Audit applications with calendar read or write permissions.
2. Review the creation and use of client secrets.
3. Rotate credentials connected to suspicious service principals.
4. Search mailboxes for the known 2050 calendar window.
5. Inspect calendar attachments before deleting forensic evidence.
6. Block or sinkhole confirmed malicious DNS infrastructure.
7. Search endpoints for AzureCommunication.dll and logAzure.txt.
8. Investigate other CAV3RN plugins on affected computers.

HOLLOWGRAPH indicators of compromise

Type	Indicator	Description
Domain	cloudlanecdn[.]com	DNS configuration recovery domain
Calendar date	2050-05-13 22:00–23:00 UTC	Fixed command, heartbeat, and result window
File	AzureCommunication.dll	Microsoft Graph communication module
File	logAzure.txt	Local Microsoft Graph configuration file
SHA-256	75e51774b8f79e5f256eaae639635f911b3e744d4774fd6068dd980255621509	HOLLOWGRAPH-related file
SHA-256	f3f3006f8304788251b153d53b305322b8acab0c66ec816b8d9f101bcc851da3	HOLLOWGRAPH-related file
SHA-256	b3d0f6e4e3be395fd7cf9e8101c89963d77216578cbb117a6ac9bc3564485eff	HOLLOWGRAPH-related file

FAQ