HollowGraph is a newly discovered .NET espionage implant that leverages Microsoft 365's Graph API to facilitate command and control. By using a compromised user's calendar as a "dead drop," the malware retrieves instructions and exfiltrates data through attachments on events scheduled as far out as the year 2050. This method allows the traffic to blend in with legitimate Microsoft 365 activity, making it difficult for traditional network security controls to detect.
The malware employs a secondary DNS-based channel to maintain access by refreshing Entra ID credentials via IPv6 AAAA records. Attributed with high confidence to the Cavern framework—linked to Iranian threat actors—HollowGraph specifically targets organizational identities rather than exploiting software vulnerabilities. Security teams are advised to monitor for anomalous Graph API activity, specifically looking for far-future calendar events and unusual DNS queries associated with the domain cloudlanecdn[.]com.
Top comments (0)