Executive Overview
In the ever-evolving landscape of enterprise cybersecurity, threat actors continuously seek out innovative methods to blend their malicious traffic with legitimate business operations. By masking attacks behind trusted enterprise platforms, cybercriminals can bypass traditional perimeter defenses and evade behavioral monitoring systems.
A striking new example of this "living-off-cloud-services" methodology has recently been uncovered by threat intelligence researchers at Group-IB. Security analysts have identified a sophisticated, highly targeted Windows malware strain designated as HOLLOWGRAPH. This novel malware subverts standard enterprise workflows by turning Microsoft 365 calendars into covert command-and-control (C2) channels.
Rather than relying on direct connections to external, attacker-controlled servers to receive instructions and exfiltrate data, HOLLOWGRAPH weaponizes the Microsoft Graph API and a compromised corporate Microsoft 365 account. It establishes a covert "two-way dead drop" using calendar events set decades into the future. By exploiting trusted Microsoft infrastructure, the malware hides its communications in plain sight, mimicking routine business software interactions.
Initial telemetry suggests the campaign is tightly focused. Group-IB researchers have identified at least 12 infected systems, with active communications observed across a narrow window between June 3 and July 9. Indicators point toward a primary focus on Israeli targets, evidenced by a compromised mailbox tied to an Israeli organization and malware samples uploaded directly from the region.
While researchers have noted technical overlaps with known threat actors—such as the Cavern backdoor framework and tentative connections to the Iranian-linked group Lyceum—the campaign’s ultimate attribution remains unconfirmed. Nevertheless, the technical design, precise execution, and reliance on heavily encrypted, cloud-native communication channels highlight a capable and well-resourced adversary. This in-depth report explores the mechanics of HOLLOWGRAPH, its supporting infrastructure, potential threat actor links, and actionable mitigation strategies for enterprise security teams.
Detailed Chronology of the Threat
The discovery of HOLLOWGRAPH stems from incident response and proactive threat-hunting operations conducted by Group-IB’s elite research teams. The timeline of this specific campaign illustrates a calculated, stealthy approach to cyber espionage, characterized by deliberate operational security and minimal footprint design.
The Observation Window: June to July
Group-IB’s tracking of the campaign revealed active communications between targeted endpoints and the compromised Microsoft 365 infrastructure during a summer operational window. While analysts identified at least 12 distinct systems infected with the HOLLOWGRAPH strain, only three of these endpoints were actively communicating with the attacker-controlled cloud mechanisms during the observation period. The earliest confirmed communication occurred on June 3, and the latest was logged on July 9.
The Geopolitical Footprint
Geographic indicators tied to the campaign suggest a deliberate, laser-focused operational scope rather than a broad, opportunistic spray-and-pray attack. Researchers linked at least one heavily compromised mailbox directly to an Israeli organization. Furthermore, analysis of malware sample telemetry and submission origins pointed to Israel as the primary geographic locus for the attacks. This narrow targeting footprint reinforces the assessment that HOLLOWGRAPH is deployed exclusively as a precision tool for high-value intelligence gathering or targeted espionage.
The Evolution of the Toolset
Technical analysis reveals that HOLLOWGRAPH does not operate as a monolithic, all-in-one backdoor. Instead, its limited command set—restricted solely to "get" for retrieving instructions and "send" for exfiltrating files—strongly indicates that it functions as a specialized modular component within a broader collection of tools.
Group-IB was able to link HOLLOWGRAPH with high confidence to the Cavern backdoor framework. This assessment is based on distinct architectural similarities and overlapping command syntax between the two malware families. The connection to Cavern suggests that threat actors are continuously updating their operational toolkits, integrating cloud-native communication channels into established frameworks to evade legacy detection mechanisms.
Technical Architecture & Mechanics: Anatomy of HOLLOWGRAPH
The core innovation of the HOLLOWGRAPH malware lies in its ingenious abuse of the Microsoft Graph API. By leveraging legitimate application programming interfaces built into the Microsoft 365 ecosystem, the malware bypasses the need for traditional, easily flagged C2 infrastructure.
The "Two-Way Dead Drop" Calendar Mechanism
At the heart of HOLLOWGRAPH’s communication strategy is the compromised account’s calendar, which functions as a secure, indirect messaging post. The mechanism operates via a two-way dead drop:
- Receiving Instructions: Attackers generate malicious calendar events containing encrypted operational commands. These events are deliberately scheduled far into the future—specifically May 13, 2050. By pushing the event timestamps decades ahead, the threat actors ensure that the entries remain completely invisible to the legitimate mailbox owner during standard daily operations or casual calendar reviews.
- Exfiltrating Files: When HOLLOWGRAPH successfully steals sensitive files or system data from a compromised endpoint, it packages the payload and uploads it as an attachment to entirely separate calendar events within the same compromised account.
Through this methodology, the malware eliminates the need for the infected endpoint to establish a direct network connection with an external C2 server. All traffic flows through legitimate Microsoft Graph API endpoints, making the network footprint indistinguishable from normal enterprise API queries and cloud synchronization tasks.
Secondary Communication: IPv6 DNS Tunneling
While the calendar serves as the primary communications pipeline, HOLLOWGRAPH maintains a resilient backup mechanism. If the primary cloud channel is disrupted or monitored, the malware shifts to Domain Name System (DNS) tunneling via IPv6 address queries.
To bootstrap this secondary channel, the malware crafts specialized IPv6 address queries directed at an attacker-controlled domain. In response, the DNS resolution returns data containing updated Microsoft Entra ID (formerly Azure AD) credentials. These vital configuration parameters include:
- Tenant ID
- Client ID
- Client Secret
- Mailbox address required to access the Microsoft Graph API
This secondary channel ensures persistence and operational resilience, allowing the malware to dynamically refresh its authentication tokens even if security teams attempt to sever its connection to the compromised mailbox.
Multi-Layered Encryption and Key Management
Security is paramount for threat actors attempting to run operations inside monitored enterprise environments. HOLLOWGRAPH protects all data traversing its covert channels using robust RSA and AES encryption.
Crucially, the malware implements a segregated key management architecture. Separate asymmetric key pairs handle incoming instructions versus outgoing exfiltrated files. This design ensures that if a security analyst or automated system manages to expose or compromise a key governing one direction of communication, the other channel remains securely encrypted, preventing total operational exposure.
Supporting Context & Metrics: The Trend of Cloud Abuse
HOLLOWGRAPH is not an isolated anomaly; rather, it represents a mature evolution in a broader, industry-wide trend: living off trusted cloud services (LotS).
The Shift to Legitimate Enterprise Infrastructure
Traditional malware operations relied heavily on hardcoded Internet Protocol (IP) addresses, custom domains, and unique C2 servers hosted on offshore bulletproof hosting providers. Over the past decade, enterprise security solutions—such as Endpoint Detection and Response (EDR) platforms, Next-Generation Firewalls (NGFWs), and advanced Secure Web Gateways (SWGs)—have become exceptionally adept at identifying and blocking unauthorized outbound connections to known malicious infrastructure.
In response, advanced threat actors have pivoted toward abusing legitimate cloud infrastructure, trusted software-as-a-service (SaaS) platforms, and enterprise APIs. By routing malicious traffic through platforms like Microsoft 365, Google Workspace, GitHub, Discord, and Telegram, attackers force defenders into a difficult dilemma: blocking the traffic or application often means breaking essential business operations.
Recent Industry Precedents
HOLLOWGRAPH’s abuse of the Microsoft Graph API parallels other sophisticated campaigns observed in recent years. Threat actors have increasingly weaponized:
- Signed Applications: Utilizing legitimate digital certificates stolen from software vendors to sign malicious binaries, tricking operating systems into trusting the payload implicitly.
- Remote Management Tools (RMM): Legitimate tools like AnyDesk, ScreenConnect, and LogMeIn are frequently deployed by attackers post-compromise to maintain persistent, interactive access that blends seamlessly with administrative traffic.
- Cloud Infrastructure & Collaboration Tools: Leveraging cloud storage buckets, enterprise messaging apps, and productivity APIs to stage attacks, exfiltrate data, and coordinate multi-stage intrusions.
Metrics of the HOLLOWGRAPH Campaign
- Total Infected Systems Identified: At least 12 endpoints.
- Active Communication Window: June 3 to July 9.
- Active Endpoints During Observation: 3 systems actively communicating.
- Command Set: Strictly limited to 2 commands ("get" and "send").
- Targeting Scope: Highly targeted; focused primarily on Israeli organizations.
Official Statements & Attribution Challenges
The sophistication of the HOLLOWGRAPH campaign has drawn intense scrutiny from the cybersecurity research community, yet definitive attribution remains elusive.
Group-IB’s Assessment on Attribution
In their published technical analysis, Group-IB researchers stated that they could not confidently attribute the campaign to a known, named Advanced Persistent Threat (APT) group. While the technical architecture shares clear DNA with the Cavern backdoor framework, linking a toolset to a broader actor profile requires corroborating intelligence beyond syntax and code reuse.
However, researchers did note intriguing technical overlaps with Lyceum (also known as HEXANE), an Iranian-linked subgroup historically associated with the OilRig (APT34) umbrella. Lyceum has a documented history of targeting Middle Eastern entities, particularly in the telecommunications, energy, and government sectors, with a heavy emphasis on Israel and neighboring states. Despite these operational and technical overlaps, Group-IB assessed the connection to Lyceum with low confidence, emphasizing that code sharing and tool recycling are rampant within the underground cybercrime and state-sponsored ecosystems.
The Profile of the Adversary
Regardless of the ultimate nation-state or criminal collective behind the operation, Group-IB’s analysts concluded that the campaign’s technical design and precise execution point unmistakably toward a "capable and well-resourced adversary." The ability to seamlessly integrate API-level manipulation of Microsoft 365 environments while maintaining encrypted, multi-channel redundancies demonstrates advanced developmental maturity and a deep understanding of enterprise cloud architectures.
Future Outlook & Comprehensive Mitigation Strategies
As organizations accelerate their migration to cloud-first productivity suites like Microsoft 365, threat actors will inevitably continue to exploit the inherent trust placed in enterprise APIs and collaborative workflows. Detecting threats that hide within legitimate business logic requires a fundamental shift in defensive strategy—moving away from simple perimeter blocking toward deep behavioral analytics and continuous cloud auditing.
Recommended Defensive Countermeasures
Security and Information Technology teams must implement a multi-layered defense to protect against advanced cloud-abusing threats like HOLLOWGRAPH. Group-IB and leading incident response authorities recommend the following proactive mitigation steps:
1. Advanced Microsoft Graph and Mailbox Monitoring
- Audit Calendar Operations: Closely monitor Microsoft Graph API activity and mailbox audit logs for anomalous calendar creation, modification, or deletion patterns.
- Hunt for Future Dates: Implement automated alerts for calendar events scheduled far into the future (such as those set for the year 2050 or beyond), as legitimate enterprise users rarely schedule operational items decades ahead.
- Inspect Attachments: Routinely scan calendar event attachments for encrypted files, high-entropy payloads, or unusual file types.
- Subject Line Anomalies: Monitor for application-generated or automated subject line changes that deviate from normal user behavior.
- Configuration File Detection: Actively search enterprise endpoints and cloud storage locations for the specific configuration file associated with the malware variant:
logAzure.txt.
2. OAuth and Application Governance
- Audit OAuth Applications: Regularly review and audit all third-party and custom OAuth applications granted permissions within the Microsoft Entra ID tenant. Revoke permissions for unverified, unused, or suspicious applications possessing broad Microsoft Graph API scopes (e.g.,
Calendars.ReadWrite,Mail.ReadWrite). - Credential Rotation: Immediately rotate any compromised administrative or service account credentials. Enforce strict multi-factor authentication (MFA) policies resistant to phishing (such as FIDO2 security keys) across all enterprise accounts.
3. Network and DNS Monitoring
- Analyze DNS Traffic: Monitor enterprise DNS query logs for unusually frequent IPv6 address queries or long, high-entropy subdomains. These patterns often serve as the telltale signature of DNS tunneling activity used for credential retrieval or covert data exfiltration.
- Egress Filtering: Restrict and monitor outbound network connections, particularly regarding anomalous protocols or unexpected external destinations communicating with internal infrastructure components.
Conclusion
The emergence of the HOLLOWGRAPH malware underscores a sobering reality for modern enterprise security: the perimeter no longer exists at the corporate firewall; it extends wherever the cloud extends. By subverting the Microsoft 365 calendar into a covert, encrypted dead drop, threat actors have demonstrated that even the most trusted, ubiquitous productivity tools can be weaponized against their users.
Defending against this new breed of cloud-native espionage requires vigilance, advanced API auditing, and a proactive threat-hunting mindset. Security teams must look beyond traditional indicators of compromise and scrutinize the very business workflows that drive daily enterprise operations. Only through comprehensive visibility into cloud API interactions and rigorous identity governance can organizations hope to unmask threats that hide in plain sight.
