⚠️ Region Alert: UAE/Middle East
A sophisticated espionage implant dubbed HollowGraph has been discovered utilizing hijacked Microsoft 365 calendars as a covert command-and-control (C2) channel. By leveraging the Microsoft Graph API, the malware communicates through legitimate traffic, making it nearly invisible to traditional network security controls. The implant, a .NET DLL, uses calendar events scheduled for the year 2050 as a two-way dead drop for receiving instructions and exfiltrating stolen data.
Technically, HollowGraph employs hybrid RSA and AES-256 encryption for all data moving through the calendar. It also maintains persistence through a secondary DNS-based channel, refreshing Entra ID credentials via IPv6 AAAA records from an attacker-controlled domain. Security researchers have linked the framework to the Cavern Manticore cluster, an Iranian-linked threat actor, noting that the campaign specifically targets organizations with high-value data while leaving a minimal footprint.
Detection requires shifting focus from patches to identity management and application permissions. Organizations are advised to audit Microsoft Graph activity for anomalous calendar changes, monitor for specific DNS query patterns, and restrict client-credential OAuth application access. Hunting for far-future calendar events with specific GUID subjects or attachment patterns is critical for identifying potential compromises.
Top comments (0)