HollowGraph: APT Malware Turns M365 Calendars into Covert C2…

HollowGraph exploits the Microsoft Graph API to transform compromised account calendars into bidirectional command-and-control channels. The highly targeted operation hit at least 12 systems, focusing on organizations in Israel with selectivity that rules out opportunistic cybercrime. The abuse of legitimate cloud infrastructure marks an evolution of living-off-the-land: no zero-day vulnerability is needed when stolen credentials and a public API suffice.

The HollowGraph malware, discovered by Group-IB and disclosed on July 20, 2026, converts the Microsoft 365 calendar function into a bidirectional command-and-control channel. The operation compromised at least 12 systems, focusing on organizations in Israel with a selectivity that rules out opportunistic cybercrime. The abuse of legitimate cloud infrastructure represents the evolution of living-off-the-land: no zero-day vulnerability is required when compromised credentials and a public API will do.

Key Takeaways

HollowGraph authenticates to the Microsoft Graph API using credentials hardcoded in the logAzure.txt file, then creates calendar events with the fictitious date of May 13, 2050 for command and data dead-drops.
The malware employs hybrid RSA plus AES-256-GCM encryption with distinct key pairs: one for inbound instructions, the other for outbound data.
A DNS tunneling channel on cloudlanecdn[.]com refreshes Entra ID credentials, carrying 14 bytes of useful payload per IPv6 AAAA response.
Command syntax and JSON tasking format match the Cavern framework, sharing technical similarities with the Lyceum threat actor without enabling high-confidence attribution.

The C2 Mechanism: When the Calendar Becomes a Secret Terminal

HollowGraph installs no proprietary servers and exploits no compromised domains for control. It leans entirely on the Microsoft ecosystem: authentication occurs through the Graph API, with tenant ID, client ID, client secret, and mailbox address stored in the configuration file. The date chosen for calendar events — May 13, 2050 — serves as a temporal anchor for the dead-drop: the malware queries exclusively the 22:00–23:00 UTC window on that non-existent day to retrieve instructions or deposit data.

Two commands structure the dialogue. The GET command searches for events titled "Event ID: " followed by a seven-character identifier, downloads attachments, and decrypts them to extract operational instructions. The SEND command instead creates events formatted as "Boss{..}ID{..}" and attaches stolen data, encrypted with the dedicated outbound RSA key. The cryptographic separation of directions — RSA plus AES-256-GCM, with distinct key pairs for inbound and outbound — prevents compromise of one flow from exposing the other.

Credential refresh occurs through an unencrypted DNS tunnel to the domain cloudlanecdn[.]com. Each AAAA query receives IPv6 responses containing 14 bytes of useful payload, assembled in sequence to reconstruct the new configuration in the logAzure.txt file. The DNS tunnel exploits a protocol almost always permitted in corporate firewalls, making the traffic indistinguishable from legitimate traffic unless deep content inspection is performed.

The Cavern Fingerprint: Shared Framework, Uncertain Attribution

Convergence between editorial sources and the Broadcom/Symantec advisory establishes with high confidence that HollowGraph belongs to the Cavern framework. The technical proof is specific: the invocation syntax "_;;__,__,_" lifted from event fields, the command "MzU=" which decodes to "003" (Toggle debug logging), the JSON tasking format with keys "cid", "type": "self" and "cmd". These elements constitute behavioral signatures of the framework rather than superficial coincidences.

In parallel, Infosecurity Magazine reports technical similarities with Lyceum, an Iranian-nexus threat actor known for Middle East operations. The dossier however contains no evidence of sufficient infrastructural overlap for high-confidence attribution: the relationship remains in the domain of technical analogies, not investigative certainty. Broadcom confirms protection of its endpoints against indicators linked to Cavern, but adds no independent attributive elements.

"HOLLOWGRAPH demonstrates a high level of technical sophistication. Its use of trusted cloud infrastructure for command-and-control, hybrid encryption, DNS tunneling for credential refresh, and highly selective victim targeting collectively suggest that the threat actor possesses significant technical capabilities and operational maturity."

Timeline and Victim Profile: A Surgical Campaign

Group-IB identified 12 compromised systems, of which only 3 showed active C2 communication during the observation period. The first victim-attacker interaction is dated June 3, 2026, the last July 9, 2026: a time window of just over a month that, combined with the low target count, depicts a precision operation rather than a mass campaign.

Targeting is geographically concentrated on Israel. The compromised mailbox is associated with an Israeli organization; uploaded files and detected Cavern framework samples originate from infrastructure in the same country. The source does not specify the victims' sector nor the nature of potentially exfiltrated data, leaving these aspects within the limits of the dossier.

Why It Matters

The brief documents no specific remedial measures released by Microsoft nor detailed operational guidance from vendors. The dossier does not specify the initial infection vector, the method of M365 credential compromise, nor the full scope of the broader Cavern campaign. The exact identity of the threat actor remains undetermined: similarities with Lyceum do not cross the threshold for high-confidence attribution.

The brief lists no concrete impacts on the data of the 12 identified victims, nor the presence of a specific CVE for the tactic employed. The source does not indicate whether Microsoft has implemented specific countermeasures beyond standard API monitoring protections.

Reading: Invisibility by Design

HollowGraph solves a classic problem of digital espionage: how to maintain a communication channel without drawing the attention of defense systems. The answer does not lie in sophisticated evasion techniques, but in hiding in plain sight. Audit logs recording Graph API calls show legitimate activity; DNS tunnels on standard ports violate no network policies; calendar events, for all their 2050 dates, reside on authentic, certified infrastructure.

The consequence for defenses is shifted: no longer the search for network anomalies in suspicious traffic, but behavioral analysis of unusual API patterns — access frequencies, query times, creativity in event dates. The calendar is no longer a compromised productivity tool, but the attack surface itself. And the line between compromise and normal use thins until it demands a contextual understanding that traditional controls, by structure, do not possess.

Sources

Information is based on the cited source and current as of publication.

Fonti

Sources and references