HOLLOWGRAPH Malware: Microsoft 365 Calendars as Hidden Command-and-Control Channel

What happened?

Group-IB has identified a targeted espionage campaign using a malware component called HOLLOWGRAPH. Instead of traditional C2 servers, the malware communicates through Microsoft 365 calendars, creating events dated May 13, 2050 containing encrypted instructions. Stolen data is inserted into new events for attackers to collect later. The infrastructure relies on legitimate use of Microsoft Graph API, making detection difficult. According to The Register, the malware obtains Entra ID credentials via DNS tunnels to maintain calendar access, and instructions are updated periodically. It does not exploit Microsoft 365 vulnerabilities but abuses its legitimate functionality.

Why is it important?

HOLLOWGRAPH represents a qualitative leap in evasion techniques. By abusing trusted cloud services, the malware camouflages itself as normal Microsoft 365 application traffic. This bypasses traditional firewalls and detection systems that do not block Graph API requests. Additionally, the campaign is highly selective: only 12 infected systems have been detected, three of them active, and the C2 mailbox belonged to an Israeli organization. This is a surgical espionage operation, not a mass attack. Group-IB linked the malware to the Cavern framework with high confidence, finding matching command formats and other implementation details. It also detected similarities with the Iranian group Lyceum, though this connection is low confidence. The technique of using cloud services as a C2 channel is not new: in 2021, TONESHELL malware used Google Drive; in 2022, APT29 abused Microsoft Teams to steal credentials. However, HOLLOWGRAPH stands out by using calendar events with future dates, reducing visibility and adding a layer of temporal obfuscation.

Consequences for businesses and users

This finding forces a rethink of security in Microsoft 365 environments. Organizations must monitor anomalous Graph API usage, such as creating events on distant dates (2050) or accessing calendars from unauthorized accounts. It is also crucial to review OAuth application permissions and limit the scope of Entra ID credentials. For users, the lesson is that trusted cloud services can be weaponized; trust should not be blind. The impact on the cybersecurity market could be significant: increased demand for anomaly detection solutions for Graph API and OAuth application behavior monitoring is expected. Companies like Vectra AI and Darktrace already offer behavior analysis, but this case underscores the need to adapt to new vectors. At the user level, although the campaign is selective, the technique could be reused in mass attacks if credential harvesting is automated.

Technical details

According to Group-IB, HOLLOWGRAPH is linked to the Cavern framework with high confidence, and shows similarities to the Iranian group Lyceum, though this connection is low confidence. The malware obtains Entra ID credentials via DNS tunnels to maintain calendar access, and instructions are updated periodically. It does not exploit Microsoft 365 vulnerabilities but abuses its legitimate functionality. The process is as follows: the malware uses a DNS tunnel to obtain previously stolen Entra ID credentials. Then, it authenticates to Microsoft Graph API and accesses the calendar of a compromised mailbox. It looks for events dated May 13, 2050, which contain encrypted instructions in attachments. After executing them, stolen data is inserted into new events with the same date for attackers to collect. The malware is lightweight: it only performs these basic functions, reducing its footprint. Group-IB identified 12 infected systems, with three active during the observation period. The C2 mailbox belonged to an Israeli organization, and malware samples were uploaded from Israel, suggesting a regional target.

What readers should know

• HOLLOWGRAPH is not an exploit but an abuse of trust in cloud services.
• The 2050 date is a red flag: any event in a corporate calendar with that date could be malicious.
• Detection requires behavioral analysis of Graph API, not just signatures.
• The campaign appears limited to intelligence targets in the Middle East, but the technique could be reused.
• Organizations should implement Graph API monitoring, review OAuth permissions, and educate users about the risk of third-party applications.
• Collaboration with Microsoft is key: the company already offers tools like Microsoft Defender for Cloud Apps to detect anomalous behaviors.

"HOLLOWGRAPH represents an advanced and highly targeted espionage threat," says Group-IB. "By hiding its C2 within legitimate Microsoft 365 traffic, it evades conventional perimeter defenses."

In conclusion, HOLLOWGRAPH marks a milestone in the evolution of C2 malware, demonstrating that trusted cloud services can be subverted for espionage operations. Companies must adapt their security strategies to include API monitoring and behavioral anomaly detection, not just network traffic analysis. The technique, though currently limited, could scale if attackers automate credential harvesting. The cybersecurity industry is watching closely, and we are likely to see more variants of this approach in the future.