HOLLOWGRAPH Turns Microsoft 365 Calendars Into Covert Malware Command Channels

A newly discovered Windows malware called HOLLOWGRAPH uses Microsoft 365 calendar events to receive commands and exfiltrate stolen files. The technique allows malicious communications to travel through legitimate Microsoft cloud infrastructure instead of a conventional attacker-controlled command-and-control server.

According to Group-IB’s HOLLOWGRAPH investigation, the malware accesses a compromised Microsoft 365 mailbox through the Microsoft Graph API. It then treats the mailbox calendar as a hidden two-way communication channel between an infected computer and its operators.

The operation appears highly targeted. Researchers found HOLLOWGRAPH on at least 12 systems, but only around three actively communicated with the attackers during the investigation. Available evidence points to a cyberespionage campaign focused on Israeli organizations.

How HOLLOWGRAPH uses Microsoft 365 calendars

HOLLOWGRAPH is a .NET NativeAOT-compiled DLL with two supported commands: get and send. The get command retrieves instructions placed in calendar events by the operator. The send command encrypts a selected file and uploads it to the same calendar through one or more attachments.

Every malicious event uses May 13, 2050, as its scheduled date. Placing the appointments far in the future reduces the chance that the mailbox owner will notice them during normal calendar use.

The malware communicates through Microsoft Graph endpoints used for calendar access, event creation and attachment uploads. This activity can resemble legitimate business traffic because it goes to Microsoft infrastructure rather than an unfamiliar external server.

Component	Purpose	Observed behavior
Microsoft Graph API	Primary command channel	Reads and creates calendar events in a compromised mailbox
Get command	Receives attacker instructions	Downloads an attachment from an event with an Event ID subject
Send command	Exfiltrates files	Uploads encrypted data as File{n}.txt attachments
DNS tunneling	Refreshes cloud credentials	Uses IPv6 AAAA queries involving cloudlanecdn[.]com
logAzure.txt	Stores configuration	Contains Microsoft Entra ID and mailbox authentication data

Stolen files hide inside calendar attachments

For incoming tasks, HOLLOWGRAPH searches a one-hour calendar window on May 13, 2050. It looks for events with subjects beginning with “Event ID:” followed by a seven-character task identifier. The malware downloads and decrypts the attachment before returning the instructions to its controller.

For outgoing data, the malware encrypts the selected file, creates another event on the same future date and splits the data into attachments named File{n}.txt. It then changes the event subject to a pattern resembling Boss{..}ID{..}, which helps the operator identify the uploaded material.

The Group-IB technical analysis says the Graph channel uses a hybrid cryptographic design combining RSA-OAEP with AES-256-GCM. Separate RSA key pairs protect incoming instructions and outgoing stolen data.

A second channel refreshes Microsoft Entra credentials

HOLLOWGRAPH also uses DNS tunneling to retrieve updated credentials for the Microsoft Graph channel. The malware generates specially encoded subdomain queries under cloudlanecdn[.]com and requests IPv6 AAAA records from the attacker-controlled domain.

The returned data can update four configuration values: the tenant ID, client ID, client secret and mailbox address. HOLLOWGRAPH writes the refreshed information to a local file named logAzure.txt. Unlike the calendar payloads, researchers said this DNS credential channel does not use encryption.

This design allows the operators to replace compromised or expired Microsoft Entra credentials without rebuilding the malware. It also gives defenders two different communication patterns to investigate: Microsoft Graph calendar activity and unusual DNS queries.

Trusted Microsoft services help the traffic blend in

HOLLOWGRAPH does not exploit a reported vulnerability in Microsoft 365 or Microsoft Graph. Instead, it abuses valid credentials, application access and normal API functionality after attackers gain access to a suitable mailbox and cloud identity.

Microsoft explains in its Graph permissions overview that application permissions can let software access organizational data without a signed-in user. An administrator must grant these permissions, and the access available to an application depends on the roles and permissions assigned to it.

Calendar write access carries particular risk because an application can create or modify events programmatically. Microsoft recommends granting applications only the minimum permissions required for their work, reducing the impact if attackers steal a client secret or compromise an application identity.

• Review applications with calendar read and write access.
• Remove unused OAuth applications and stale client secrets.
• Limit application access to the mailboxes required for legitimate operations.
• Rotate exposed Microsoft Entra credentials immediately.
• Investigate unexpected app-only access to Exchange Online resources.

Researchers connect HOLLOWGRAPH to the Cavern framework

Group-IB attributes HOLLOWGRAPH to the Cavern backdoor framework with high confidence. Researchers identified matching command delimiters, task structures and an encoded self-command also associated with Cavern components.

Check Point Research’s Cavern Manticore analysis describes Cavern as a modular command-and-control framework connected to Iran-nexus activity. Its components support functions such as file management, network scanning, database access and tunneling.

The evidence does not establish who operated HOLLOWGRAPH. Group-IB found technical similarities with Lyceum, an Iran-linked group also associated with the OilRig cluster, but assessed that connection with low confidence. It said the available evidence was not distinctive enough for firm attribution.

A separate Cavern framework investigation also noted similarities with Lyceum tradecraft, including fixed command verbs and the use of victim-side infrastructure to proxy command traffic. These overlaps support an Iranian nexus without identifying a specific operator.

Campaign activity focused on Israeli targets

The earliest communication observed between an infected system and the attackers occurred on June 3, 2026. The latest activity identified during the investigation took place on July 9, 2026.

Researchers connected the operation to an Israeli mailbox used for exfiltration, while related malware samples were uploaded from Israel. Combined with the small number of detected infections, these findings suggest a carefully selected espionage campaign rather than widespread malware distribution.

Security teams should not assume that every Microsoft 365 tenant faces an active HOLLOWGRAPH infection. However, the technique demonstrates how attackers can repurpose trusted cloud platforms to conceal command traffic and data theft.

How organizations can detect HOLLOWGRAPH

Defenders can start by searching Exchange and Microsoft 365 telemetry for unusual calendar events dated May 13, 2050. Events created by an application, particularly those containing attachments or later subject changes, deserve additional investigation.

Organizations should also inspect Microsoft Entra records for unexpected permission grants, client-secret creation and changes to enterprise applications. Microsoft provides instructions for reviewing application permission audit logs across a tenant or for a specific resource application.

Useful HOLLOWGRAPH indicators include:

• Calendar events scheduled for May 13, 2050
• Subjects beginning with Event ID:
• Subjects following a Boss{..}ID{..} pattern
• Attachments named File{n}.txt
• The file logAzure.txt on Windows systems
• IPv6 AAAA queries involving cloudlanecdn[.]com
• Application-driven event creation, attachment uploads or subject changes

Administrators should review the Microsoft Entra application audit records to determine who granted or revoked permissions and when those changes occurred. Suspicious applications should have their credentials revoked before investigators examine affected mailboxes and endpoints.

The Microsoft Graph security guidance recommends applying least privilege to every application. Organizations should combine that approach with regular credential rotation, mailbox auditing, endpoint monitoring and DNS analysis.

HOLLOWGRAPH shows why defenders must monitor trusted cloud traffic as closely as connections to unknown domains. Valid Microsoft services can carry malicious commands when attackers compromise the identities and permissions required to access them.

FAQ