HollowGraph hides C&C inside Microsoft 365 calendars

Security researcher Group-IB described a newly discovered malware family it calls HollowGraph that hides command-and-control traffic inside a compromised Microsoft 365 calendar. The implant uses the Microsoft Graph API and a Microsoft 365 account tied to Israel to blend malicious activity with normal mailbox traffic. Observed calendar events were dated May 13, 2050.

Group-IB described the mailbox calendar as a two-way dead-drop: operators create calendar events containing tasking and attached payloads, while the implant searches for those events and creates its own appointments to carry stolen files as encrypted attachments.

HollowGraph does not fetch payloads from an external attacker-controlled server. Instead the implant supports two built-in commands: ‘send’, which generates calendar appointments with files attached, and ‘get’, which searches for operator-planted appointments and downloads new instructions. The attached files use hybrid RSA and AES encryption.

The malware maintains a secondary channel that uses DNS tunneling to refresh its configuration and retrieve Microsoft Entra ID credentials used for authentication. When executed, the implant writes a hardcoded configuration file named logAzure.txt to disk. That file contains the Entra tenant ID, client ID and secret, the target mailbox address, a C&C domain and two RSA keys.

Group-IB recovered 12 victims, three of which were actively communicating with attacker infrastructure. The earliest observed communication occurred on June 3. The recovered indicators included an Israeli mailbox used for exfiltration and samples uploaded from Israel. Group-IB reported technical similarities between HollowGraph and variants of the Cavern framework and noted overlaps with an Iran-linked subgroup known as Lyceum, but classified attribution as low confidence.

Because Microsoft Graph is a supported API for accessing Microsoft 365 data and calendar events with attachments are common in business mailboxes, the report states the technique can hide malicious traffic inside routine service calls. The Group-IB report lists indicators of compromise and configuration artifacts observed in samples that organizations can use to investigate potential intrusions.

Security teams examining Microsoft 365 environments may review unusual calendar entries, especially events with future dates and unexpected attachments, application registrations and secrets in Entra ID, and anomalous DNS traffic that could indicate tunneling.