Stealth in Plain Sight: How the HOLLOWGRAPH Malware Weaponizes Microsoft 365 Calendars for Covert Operations

Executive Overview

Cybersecurity researchers at international threat intelligence firm Group-IB have uncovered a sophisticated and highly targeted Windows malware strain that fundamentally subverts standard enterprise cloud workflows. Dubbed HOLLOWGRAPH, this novel malware weaponizes legitimate cloud architecture—specifically Microsoft 365 calendars—transforming ordinary scheduling tools into covert command-and-control (C2) channels and data exfiltration routes.

Rather than relying on traditional, easily detectable connections to external, attacker-controlled servers, HOLLOWGRAPH leverages the Microsoft Graph API and a compromised Microsoft 365 tenant account to blend seamlessly into routine enterprise communications. By hijacking cloud-native features, the malware hides its operational heartbeat inside legitimate business infrastructure, bypassing standard perimeter network defenses and evading casual administrative oversight.

The core mechanism of HOLLOWGRAPH revolves around what analysts have termed a "two-way dead drop." Attackers upload encrypted operational instructions into calendar event fields, while the infected endpoint silently drops exfiltrated files as email attachments into separate calendar entries. To ensure these covert communications remain entirely invisible to the legitimate mailbox owner, threat actors schedule these manipulated events far into the future—specifically targeting the date of May 13, 2050. This clever temporal placement keeps the malicious traffic entirely out of sight during standard day-to-day calendar reviews, while remaining programmatically accessible via API calls.

Group-IB’s high-confidence technical analysis has linked HOLLOWGRAPH to the broader Cavern backdoor framework, highlighting architectural and syntactical overlaps that suggest it is engineered as a specialized component within a larger, modular cyber-espionage toolkit. While the observable victim footprint remains remarkably small—comprising roughly a dozen identified systems with only three actively communicating during the observation window—the campaign’s geographic concentration in Israel, combined with its sophisticated evasion mechanisms, points directly to a well-resourced, highly calculated threat actor.

This campaign represents a critical evolution in enterprise threat actor tactics, techniques, and procedures (TTPs). As organizations increasingly migrate their operations to cloud environments, adversaries are adapting by "living off the cloud"—abusing trusted APIs, native enterprise tools, and legitimate business infrastructure to execute espionage campaigns without tripping traditional security tripwires.

Detailed Chronology: Uncovering the HOLLOWGRAPH Campaign

The discovery of HOLLOWGRAPH is the result of deep threat hunting and incident response telemetry analyzed by Group-IB’s elite threat intelligence teams. While the exact genesis of the campaign remains obscured by layers of obfuscation, forensic timelines constructed from observed network traffic and endpoint artifacts reveal a calculated progression of deployment, communication, and exfiltration.

Initial Compromise and Credentials Acquisition

Before HOLLOWGRAPH can begin its calendar-based communications, the infected endpoint must establish authenticated access to the Microsoft Graph API. The malware achieves this through an ingenious secondary communication channel utilizing Domain Name System (DNS) tunneling.

When initialized, HOLLOWGRAPH generates specially crafted IPv6 address queries directed toward an attacker-controlled authoritative name server. These high-entropy queries transmit system-level telemetry and request updated Microsoft Entra ID credentials. In response, the malicious DNS infrastructure supplies the necessary tenant ID, client ID, client secret, and target mailbox address. This programmatic retrieval mechanism ensures that even if hardcoded credentials are rotated or blocked by security teams, the malware can dynamically refresh its access parameters without triggering conventional HTTPS alerts that might be flagged by web proxies or secure web gateways (SWGs).

Armed with valid OAuth application credentials and Microsoft Graph API access tokens, HOLLOWGRAPH bypasses standard endpoint protection mechanisms, authenticating directly against Microsoft’s cloud infrastructure as a legitimate API client.

Establishing the Two-Way Dead Drop

With API access secured, the malware initiates its primary operational loop, interacting exclusively with a compromised Microsoft 365 mailbox calendar. Group-IB researchers observed this communication cycle operating across a defined temporal window:

• Earliest Observed Communication: June 3
• Latest Observed Communication: July 9

During this period, the malware relied entirely on two fundamental operational commands, indicative of a lean, modular design:

1. "get": Retrieves newly uploaded encrypted instructions from the attacker-controlled calendar.
2. "send": Exfiltrates compressed or raw stolen files by uploading them as attachments to separate, newly generated calendar events.

To maintain operational security and avoid raising the suspicions of the legitimate user whose mailbox has been hijacked, the threat actors manipulate the temporal parameters of these calendar entries. Every malicious event—whether containing incoming instructions or outgoing exfiltrated data—is programmatically scheduled for May 13, 2050. Because standard calendar user interfaces (UI) display current schedules, appointments set decades into the future do not appear in daily, weekly, or monthly agenda views. Yet, because these events exist within the database backend, they are easily queried programmatically via the Microsoft Graph API.

Encryption and Data Protection Layers

Security analysts examining the captured network streams and endpoint memory dumps noted that all payloads transiting the Microsoft 365 calendar infrastructure are heavily fortified using robust cryptographic standards.

HOLLOWGRAPH implements a dual-layer cryptographic framework utilizing both RSA and AES encryption algorithms. Incoming commands and outgoing data packets are never stored in plaintext on disk or within the calendar database. Furthermore, the malware utilizes separate cryptographic key pairs for incoming instructions versus outgoing exfiltrated files. This intentional architectural segregation ensures that if security researchers or incident responders manage to compromise one key pair during an investigation, the operational security of the opposing communication direction remains completely intact.

Supporting Context & Metrics: Technical Analysis and Attribution

To contextualize the threat posed by HOLLOWGRAPH, it is essential to examine its technical footprint, infrastructure markers, and the broader threat intelligence landscape surrounding its deployment.

Scale, Scope, and Targeting Metrics

Group-IB’s telemetry indicates that the HOLLOWGRAPH campaign is exceptionally narrow in scope, emphasizing precision over mass distribution:

• Total Identified Infected Systems: At least 12 individual endpoints globally.
• Active Communication Window: Only 3 of the 12 identified systems were actively transmitting data and polling commands during Group-IB’s active monitoring phase.
• Geographic Concentration: Primary indicators—including a compromised mailbox linked directly to an Israeli entity and malware samples uploaded from IP spaces within Israel—strongly suggest that the campaign’s operational focus is centered on Israeli targets.

This microscopic infection footprint underscores the targeted nature of the operation. Unlike widespread ransomware campaigns or opportunistic commodity infostealers that harvest millions of credentials indiscriminately, HOLLOWGRAPH behaves like a precision-guided instrument designed for persistent corporate or governmental espionage.

Code Architecture and Attribution Challenges

Through meticulous binary analysis, Group-IB researchers identified strong code-level and architectural similarities between HOLLOWGRAPH and the established Cavern backdoor framework. Specifically, the command syntax paradigms, execution flows, and structural design choices mirror those previously documented in Cavern operations.

However, attributing the campaign to a definitive, known threat actor group remains complex:

• The Lyceum Connection: Researchers identified minor technical overlaps with Lyceum (also known as Desert Falcon or Mercurial), a recognized Iranian-linked threat subgroup historically associated with OilRig (APT34).
• Confidence Level: Despite these technical parallels, Group-IB has assessed the connection to Lyceum with low confidence, noting that shared code libraries, common proxy techniques, and modular architecture are frequently bought, sold, or shared across disparate underground developer ecosystems.

Regardless of the precise organizational moniker attached to the threat actors, Group-IB’s analysis paints a clear picture of the adversary: the deployment of custom Windows binaries, advanced cryptographic segregation, custom DNS tunneling over IPv6, and the abuse of native cloud APIs demonstrate the operational maturity of a capable and well-resourced adversary.

The Broader Threat Landscape: Living off the Cloud

HOLLOWGRAPH is not an isolated anomaly; rather, it represents a mature evolution in contemporary cyberattack methodology. For years, threat actors relied on custom, dedicated infrastructure—spinning up Virtual Private Servers (VPS), configuring Command and Control panels (such as Cobalt Strike or Brute Ratel), and utilizing hardcoded external IP addresses. These traditional infrastructures left glaring indicators of compromise (IoCs) that modern Endpoint Detection and Response (EDR) platforms and network monitoring tools could easily flag and block.

In response, advanced persistent threat (APT) groups and sophisticated cybercrime syndicates have shifted toward "Living off the Cloud" (LotC) and "Living off Trusted Sites" (LotS) techniques. By leveraging legitimate, trusted enterprise platforms—such as Microsoft 365, Google Workspace, GitHub, Slack, and Discord—attackers effectively camouflage their malicious traffic inside the legitimate noise of corporate network activity.

When a security operations center (SOC) analyst reviews firewall logs and observes outbound HTTPS connections to Microsoft’s legitimate cloud endpoints (graph.microsoft.com), the traffic is almost universally classified as benign, routine business communication. Security tools cannot trivially block Microsoft Graph API calls without crippling essential enterprise operations. Threat actors exploit this inherent blind spot, turning trusted productivity tools into weaponized command channels. Recent campaigns have similarly abused signed legitimate applications, remote desktop management solutions, and cloud storage buckets to achieve the exact same goal: blending malicious operations into familiar, authorized enterprise workflows.

Expert Recommendations and Defensive Mitigations

Because HOLLOWGRAPH deliberately mimics legitimate administrative and user behaviors within cloud environments, traditional perimeter defenses are fundamentally insufficient to detect its presence. Defending against calendar-based C2 channels requires a proactive, multi-layered security strategy focused on cloud API monitoring, anomaly detection, and rigorous credential hygiene.

Group-IB and enterprise security architects recommend that organizations implement the following mitigation steps immediately:

1. Advanced Microsoft Graph and Mailbox Auditing

• Monitor API Access Logs: Security teams should rigorously audit Microsoft Graph API access logs, paying strict attention to anomalous application permissions, unusual token acquisition patterns, and high volumes of programmatic calls originating from unexpected IP spaces.
• Inspect Calendar Anomalies: Implement automated scripts or specialized security information and event management (SIEM) rules to scan Microsoft 365 mailboxes for suspicious calendar properties. Specifically, look for:
  • Calendar events scheduled far into the future (e.g., dates extending into the 2050s).
  • Events featuring encrypted text attachments, high-entropy binary blobs, or unrecognized file formats.
  • Unexpected subject line modifications or metadata alterations generated programmatically rather than by human interaction.
  • The presence of anomalous configuration files, such as the logAzure.txt artifact frequently associated with these campaigns.

2. OAuth Application and Credential Hardening

• Audit Enterprise Applications: Regularly review and audit all registered OAuth applications within Microsoft Entra ID. Revoke permissions for any third-party or unverified applications that hold excessive access rights to user mailboxes (Mail.ReadWrite, Calendars.ReadWrite).
• Credential Rotation: Immediately rotate exposed or suspected client secrets, tenant credentials, and service account passwords. Implement strict Multi-Factor Authentication (MFA) policies that cannot be easily bypassed by token-replay or session-hijacking techniques.

3. Network Monitoring for DNS Tunneling

• Analyze IPv6 and DNS Telemetry: Because HOLLOWGRAPH relies on DNS tunneling via IPv6 queries to retrieve updated configuration parameters, network administrators should monitor internal DNS servers for anomalous patterns.
• Detect High-Entropy Queries: Watch for unusually frequent, long, or high-entropy subdomains being queried via IPv6 address requests. These symptoms often indicate data exfiltration or command retrieval via DNS covert channels.

Future Outlook

The emergence of HOLLOWGRAPH signals a troubling paradigm shift in cloud security. As enterprise organizations continue their migration to cloud-first and hybrid infrastructures, adversaries are systematically developing tools designed to exploit the very administrative APIs intended to streamline business productivity.

We can anticipate that future iterations of cloud-native malware will further refine these techniques—abandoning external infrastructure entirely in favor of multi-tenant, cloud-to-cloud communications. In this evolving landscape, the perimeter is no longer defined by the corporate firewall, but by identity management, API governance, and behavioral visibility across SaaS platforms.

For defenders, the takeaway is clear: security visibility cannot stop at the operating system kernel or the network gateway. Modern security operations teams must extend their telemetry pipelines directly into cloud APIs, collaboration suites, and productivity tools to detect the subtle anomalies that reveal threats operating quietly in plain sight.