A newly discovered espionage implant, dubbed HollowGraph by Group-IB, is employing a highly sophisticated and stealthy command-and-control (C2) mechanism. This malware hijacks compromised Microsoft 365 calendars, embedding operator instructions and exfiltrating stolen data as attachments on calendar events dated far into the future, specifically 2050. By leveraging legitimate Microsoft Graph API traffic, HollowGraph's activity masquerades as normal Microsoft 365 chatter, making it exceptionally difficult to detect with traditional network controls. The .NET DLL implant supports get and send commands, with all communications secured using hybrid RSA and AES-256 encryption.
In addition to the calendar-based C2, HollowGraph maintains a second, cruder DNS channel. This channel, operating over IPv6 AAAA records from cloudlanecdn[.]com, is used to refresh Entra ID (Azure AD) login details, which are then written to a file named logAzure.txt. Group-IB attributes HollowGraph with high confidence to Cavern (also known as Cavern Manticore), an Iranian Ministry of Intelligence and Security-linked actor that overlaps with MuddyWater and Lyceum. The attacks are highly targeted espionage, found on a small number of machines, with victim traffic observed as recently as July 2026.
Since HollowGraph exploits normal Microsoft Graph API functionality rather than a software vulnerability, detection focuses on identity and application permissions monitoring. Defenders should look for specific indicators, including far-future calendar events on 2050-05-13 with bare GUID subjects or File{n}.txt attachments. Auditing client-credential OAuth apps, monitoring Microsoft Graph and mailbox activity for application-driven calendar changes, and scrutinizing DNS for frequent AAAA queries to suspicious domains like cloudlanecdn[.]com are crucial steps to identify this elusive threat.
Top comments (0)