A newly identified espionage tool, dubbed HollowGraph, has been discovered leveraging Microsoft 365 calendars to covertly manage command-and-control (C2) communications and exfiltrate stolen data. This innovative approach allows the malware to blend seamlessly with legitimate Microsoft Graph API traffic, making detection challenging.
Exploitation of Microsoft 365 Calendars
HollowGraph operates by embedding operator instructions and exfiltrated data within calendar events set to the distant future, specifically the year 2050. This tactic ensures that the malicious events remain unnoticed by users, as they are unlikely to scroll to such far-off dates. The malware utilizes the compromised mailbox’s calendar as a bidirectional communication channel:
- Command Retrieval: The malware queries the calendar for events dated ‘2050-05-13’ that contain operator instructions in attached files.
- Data Exfiltration: Stolen data is encrypted and uploaded as attachments to newly created future-dated events.
All data transmitted through this method is secured using a combination of RSA and AES-256 encryption, with distinct key pairs for incoming commands and outgoing data.
Secondary Communication Channel
In addition to the calendar-based C2 mechanism, HollowGraph employs a secondary channel to maintain access credentials. It uses DNS queries to refresh the application’s Entra ID (formerly Azure AD) login details, including tenant ID, client ID, client secret, and target mailbox. These credentials are extracted from IPv6 AAAA records returned by the attacker-controlled domain ‘cloudlanecdn[.]com’ and stored in a file named ‘logAzure.txt,’ masquerading as a routine log file. Notably, this channel transmits data in plaintext, contrasting with the encrypted calendar communications.
Attribution and Impact
Security researchers have identified similarities between HollowGraph and the Cavern backdoor framework, previously linked to Iranian state-sponsored groups such as MuddyWater and Lyceum. However, definitive attribution remains elusive. The malware has been detected on at least 12 machines, with active communication observed on approximately three systems between June 3 and July 9, 2026. The limited scope suggests a targeted espionage campaign rather than widespread cybercrime.
Importantly, HollowGraph does not exploit any vulnerabilities within Microsoft software. Instead, it capitalizes on compromised accounts and the standard functionality of the Microsoft Graph API, underscoring the necessity for robust identity and access management practices.
Detection and Mitigation Strategies
To identify potential HollowGraph infections, organizations should monitor for unusual calendar events with the following characteristics:
- Events dated far into the future, particularly on ‘2050-05-13.’
- Event subjects consisting of GUIDs or patterns like ‘Event ID:’ or ‘Boss{..}ID{..}.’
- Attachments named ‘File{n}.txt.’
Additionally, vigilance over DNS traffic for unexpected queries to domains such as ‘cloudlanecdn[.]com’ can aid in detecting the secondary communication channel. Implementing stringent access controls, regularly reviewing application permissions, and monitoring for anomalous activities are crucial steps in mitigating the risks associated with such sophisticated malware.
The emergence of HollowGraph highlights the evolving tactics of cyber adversaries who exploit legitimate services to evade detection. This development serves as a reminder for organizations to adopt comprehensive security measures that encompass both technological defenses and user awareness to counteract these advanced threats.
