HOLLOWGRAPH malware turns a normal Microsoft 365 Calendar into a covert espionage channel, with commands and stolen files hidden inside appointments dated 13 May 2050. That matters most for organizations where Microsoft 365 is treated as trusted internal plumbing, because the traffic can blend into routine cloud activity instead of looking like a classic malware callback, according to Help Net Security.
Researchers at Group-IB identified 12 infected systems, with three actively communicating, in what the company describes as a narrowly targeted operation against Israeli entities. The earliest recorded victim contact was June 3, 2026, and the latest was July 9, 2026.
“Based on the evidence currently available, we cannot confidently attribute this activity to any previously identified threat actor. However, our analysis identified several technical similarities with the Iranian-nexus threat actor Lyceum,” researchers said.
Why Microsoft 365 defenders should care about HOLLOWGRAPH malware now
The dangerous part of HOLLOWGRAPH malware is not that it abuses some obscure corner of Windows. It hides inside a business workflow that security teams usually expect to be boring: calendar events.
Group-IB says HOLLOWGRAPH is part of a broader toolkit linked with high confidence to the Cavern backdoor framework, a modular espionage toolkit previously tied to Iran-linked activity. That framing matters. This is espionage tradecraft, not loud ransomware behavior.
The malware uses Microsoft Graph API access to interact with a compromised Microsoft 365 mailbox. Instead of asking an obvious attacker server for instructions, it checks calendar entries. Instead of uploading stolen files to a suspicious endpoint through a conventional channel, it can attach encrypted output to calendar events.
Who is most exposed?
Organizations that rely heavily on Microsoft 365 and don’t inspect calendar objects, OAuth app activity, or Graph API behavior with the same seriousness as email attachments are the obvious concern.
This follows the same defensive lesson seen in endpoint-focused research such as Windows Bind Link Attacks Trick EDR Into Clean Scans: attackers keep looking for places defenders trust too much.
How HOLLOWGRAPH turns 2050 calendar appointments into command channels
HOLLOWGRAPH has only two commands: get and send. That simplicity is the point. It doesn’t need a sprawling command set if its job is to move instructions and files quietly through Microsoft 365.
Here’s the workflow Group-IB described:
| Step | HOLLOWGRAPH behavior |
|---|---|
| Tasking | The attacker creates a calendar event with attached command data |
| Polling | The malware checks the mailbox calendar through Microsoft Graph API |
| Execution | It reads the attached encrypted instruction |
| Exfiltration | It creates a new calendar event and attaches encrypted stolen files |
| Concealment | Events are dated 13 May 2050 to avoid normal user attention |
Why date everything decades ahead? Because a calendar entry in 2050 is still accessible through APIs, but it won’t sit in front of the mailbox owner’s daily schedule.
This is not described as a Microsoft 365 vulnerability. The attacker still needs a compromised account, valid credentials, tokens, or an endpoint foothold that lets the implant interact with the environment. The abuse happens after trust has already been obtained.
Where Cavern fits into the Iranian espionage picture
Cavern is described as a modular espionage framework made from separate plugins, with each component handling a different task. HOLLOWGRAPH appears to be the communications piece built around Microsoft 365 calendars.
Group-IB links HOLLOWGRAPH with high confidence to the Cavern framework and Iranian espionage activity. It also found technical similarities with Lyceum, an Iranian-nexus threat actor, but the company explicitly rated that link as low confidence.
That distinction matters. “High confidence to Cavern” is not the same thing as “definitively operated by Lyceum.” The evidence supports a toolkit relationship more strongly than a named-actor attribution.
What does that say about the operation?
XOOMAR analysis: HOLLOWGRAPH shows how modular espionage tools can make cloud services part of the control plane. One plugin handles calendar-based communication. Another part of the operation may handle access, collection, or other tasks. That modularity lets operators swap components without rebuilding the entire toolkit.
A practical HOLLOWGRAPH scenario inside a Microsoft 365 company
Picture a government contractor using Microsoft 365 for email and scheduling. One mailbox is compromised. A Windows host inside the organization runs the HOLLOWGRAPH implant.
This is a teaching scenario based on Group-IB’s reported tactics, not a claim about a specific victim.
The attacker creates a calendar appointment dated 13 May 2050. The event carries an encrypted attachment. HOLLOWGRAPH checks the calendar through the Graph API, reads the task, and collects files from the machine.
The implant then creates another 2050 calendar event and attaches encrypted output for the operator to retrieve. To the employee, nothing appears on today’s calendar. To a security tool that treats Microsoft cloud traffic as routine, the activity may look like an application interacting with mailbox data.
A separate channel handles credential renewal. Related reporting says the malware uses DNS tunneling through IPv6 AAAA queries to the attacker-controlled domain cloudlanecdn[.]com, with refreshed Microsoft Entra ID credential data stored in a file disguised as logAzure.txt.
That’s the defender’s problem in one sentence: the suspicious behavior is split across cloud API activity, mailbox objects, endpoint files, and DNS traffic.
How security teams can hunt HOLLOWGRAPH-style calendar abuse
Group-IB’s detection guidance gives defenders concrete places to start. Security teams should search for calendar events dated May 13, 2050, especially with subject patterns such as Event ID: or Boss{..}ID{..}, and attachments named File{n}.txt.
They should also review mailbox audit logs for calendar changes made by applications rather than users.
Useful hunt areas include:
- Calendar objects: Far-future events, strange attachment names, encoded-looking payloads, or abnormal event creation patterns.
- Graph API activity: Accounts or apps creating and modifying calendar items outside normal behavior.
- Entra ID signals: Suspicious tokens, new client secrets, unusual OAuth2 client-credential usage.
- DNS telemetry: Unusual IPv6 AAAA lookups, especially repeated queries to attacker-controlled infrastructure.
- Endpoint artifacts: Files disguised as logs, including names such as logAzure.txt when seen with other indicators.
Allow-listing Microsoft domains won’t solve this. The traffic can be legitimate Microsoft 365 traffic carrying malicious instructions because the attacker is operating through trusted services.
For teams triaging Microsoft security debt more broadly, our coverage of AI Buries Microsoft Patch Tuesday Under Record 570 Fixes is a useful companion to this cloud-focused case.
What organizations should change after HOLLOWGRAPH
The immediate fix is identity discipline. Group-IB recommends restricting and auditing OAuth2 apps that use client credentials, alerting when new client secrets are created, applying Conditional Access, rotating credentials, and watching for unusual tokens.
Security teams should also update incident response playbooks. A Microsoft 365 investigation can’t stop at inbox rules and suspicious emails. Calendar objects, Graph API logs, OAuth grants, Entra ID sign-ins, DNS telemetry, and endpoint artifacts all belong in the same case file.
The practical takeaway is blunt: collaboration platforms are now part of the espionage attack surface. If defenders inspect email but ignore calendars, they leave a quiet channel open.
The next watch item is whether HOLLOWGRAPH remains a narrowly targeted tool or whether similar calendar-based command channels appear in other campaigns. Either way, Microsoft 365 calendars now deserve the same defensive scrutiny as mailboxes, tokens, and endpoint processes.
Impact Analysis
- HOLLOWGRAPH abuses trusted Microsoft 365 workflows, making espionage traffic harder to distinguish from normal business activity.
- The campaign appears narrowly targeted at Israeli entities, with 12 infected systems identified by Group-IB.
- Its links to the Cavern backdoor framework and similarities to Lyceum suggest sophisticated state-aligned espionage tradecraft.
Originally published on XOOMAR. For more news and analysis, visit XOOMAR.
Top comments (0)