HOLLOWGRAPH Hides Malware C2 in Microsoft 365 Calendars

HOLLOWGRAPH is a Windows implant that does not need a conventional command-and-control server to receive tasks and send files. It abuses a compromised Microsoft 365 account, Microsoft Graph API, and calendar events as a bidirectional dead drop. Commands and results travel in attachments to meetings dated 13 May 2050, while a separate DNS tunnel over AAAA records refreshes Entra ID credentials. To a firewall, the primary traffic resembles legitimate communication with Microsoft cloud services, so detection must move from domain reputation to identity, API behavior, mailbox activity, and DNS.

Group-IB published its HOLLOWGRAPH analysis on 20 July 2026. The team identified at least 12 infected systems, with roughly three actively communicating with the operator during observation. The earliest confirmed traffic occurred on 3 June and the latest on 9 July. Telemetry suggests targeted interest in Israeli entities rather than a broad opportunistic campaign.

Confirmed facts

HOLLOWGRAPH is a .NET NativeAOT-compiled DLL. It supports only two functions called get and send because it is a component of a larger toolkit. Get retrieves an attachment from a prepared calendar event, decrypts the task, and returns it to the loader. Send encrypts a selected file, divides it into attachments, and creates an event for the operator to collect.

Group-IB links the command format and component behavior to the Cavern framework with high confidence. It assesses only a low-confidence potential relationship with the Iran-nexus actor Lyceum. HOLLOWGRAPH should therefore not be described as a confirmed tool of a named group. Technical similarity supports a framework-family judgment, not operator identity.

Layer	Confirmed behavior
host	.NET NativeAOT DLL and logAzure.txt configuration
primary C2	Microsoft Graph API and a compromised mailbox calendar
task retrieval	attachments in events dated 13 May 2050 with Event ID subjects
exfiltration	encrypted FileN.txt attachments in new events
secondary channel	DNS tunneling through AAAA queries
cryptography	RSA-OAEP and AES-256-GCM, separate keys by direction
observed scale	at least 12 hosts, approximately 3 active
attribution	Cavern: high confidence; Lyceum: low confidence

The calendar as a dead drop

The operator creates an event in a compromised mailbox at a fixed date in 2050 and attaches a command. The implant queries calendarView for a narrow time range and a subject containing a task identifier, downloads the attachment, and decrypts it. When sending data, it creates its own meeting, adds encrypted fragments in FileN.txt attachments, and renames the subject to a pattern recognized by the operator.

The distant date reduces the likelihood that a mailbox owner will see the event in an everyday view. It does not hide the object from APIs, audit records, or search. For defenders, that creates a stable signal: machine-created meetings on 13 May 2050, unusual subject patterns, and a series of small text attachments are more durable than an IP address that can change.

The channel uses Microsoft infrastructure but is not fileless. Calendar objects and attachments exist in M365, while an implant and configuration exist on the host. Threat hunting should join both views. Blocking Graph completely can break legitimate applications, while deleting events does not remove host malware.

Encryption protects the attacker’s operation

HOLLOWGRAPH uses hybrid encryption. A random AES-256-GCM key protects the payload, and RSA-OAEP wraps that symmetric key. Separate RSA pairs serve incoming tasking and outbound exfiltration. Compromise of one communication direction therefore does not necessarily expose the other.

For a SOC, attachment inspection will not reveal a plain command or document. Encrypted, high-entropy content in a calendar remains anomalous. Detection does not need to break cryptography. It can identify the combination of application authentication, calendarView access far in the future, event creation without a normal client, text attachments with high entropy, and a repeated subject scheme.

Do not attempt to decrypt evidence by executing a sample. Memory and configuration analysis may reveal keys in a controlled laboratory, but production response should prioritize isolation, evidence preservation, and credential revocation.

DNS tunneling refreshes Entra credentials

The implant must preserve Microsoft Graph access. A second channel therefore delivers the tenant ID, client ID, client secret, and mailbox address through specially encoded IPv6 responses. HOLLOWGRAPH makes AAAA queries to the defanged cloudlanecdn[.]com domain. Responses provide data length and fragments that the malware reassembles and writes to logAzure.txt.

DNS does not replace primary C2; it maintains configuration and credentials. This demonstrates why HTTP proxy monitoring alone is insufficient. Resolvers should log names, record types, clients, responses, and frequency. Long structured subdomains, sequential AAAA queries, and repeated IPv6 lookups from a host that rarely needs IPv6 deserve analysis.

Our DNS tunneling detection guide explains the technical foundation. A strong rule combines entropy, label length, NXDOMAIN behavior, record type, and host baseline instead of blocking all AAAA records.

An application identity becomes part of C2

The configuration contains a tenant ID, client ID, client secret, and mailbox. This points to application authentication rather than a normal interactive user sign-in. A classic “impossible travel” alert may see nothing because an application acts without a person through a predictable OAuth flow.

Entra teams should review service principals, applications, secrets, Graph permissions, and last use. Focus on apps with mailbox or calendar access, long-lived credentials, owners no longer on the responsible team, and administrative consent without a change ticket.

Least privilege applies to APIs too. An application designed for one calendar should not automatically receive global mailbox access. The pattern in our AI agent and non-human identity guide applies directly: inventory, owner, short-lived credential, narrow scope, and telemetry.

Microsoft 365 detection

Preserve Unified Audit Log, application sign-in logs, and service-principal sign-ins first. Then search for combinations of:

events dated 13 May 2050 created by an unusual application;
calendarView queries covering a narrow far-future window;
subjects containing Event ID or a Boss-and-ID pattern;
attachments named File0.txt, File1.txt, and similar;
sequential create, attachment upload, and rename/PATCH operations;
application access to a mailbox whose owner does not recognize the integration;
a new client secret or credential change without approval;
large data volume in calendar attachments.

None of these is malicious in isolation. Tests, calendar automation, and archiving may create distant events. A rule should require several properties and identity context. When it fires, do not delete everything immediately. Export object content, metadata, identifiers, and audit logs to preserve the timeline.

Combine the review with a broader Microsoft 365 security assessment covering application consent, mail rules, MFA, and audit retention.

Host and network detection

On Windows, look for NativeAOT DLLs loaded by an unusual parent, logAzure.txt outside a legitimate context, a process performing both DNS queries and Graph connections, and recent changes in working directories. A filename alone is insufficient; legitimate software can create the same log name. Correlate digest, path, parent process, signature, and first execution.

Monitor the IOC domain and tunnel shape at the network layer, but do not stop there. An operator can change the domain, tenant, or mailbox. More stable behaviors are structured-label AAAA queries, a new application talking to Graph, and substantial calendar-attachment traffic from a host that is not a mail client.

EDR, DNS, and M365 events need one timeline. Sigma-based detection engineering can express vendor-neutral logic, but Graph and Entra fields require local mapping.

Step-by-step response

Isolate the suspicious host while preserving memory-acquisition capability.
Collect the DLL, configuration, memory, process, DNS, and proxy logs.
Export the 2050 events and mailbox audit records.
Disable the identified application and revoke its secret after evidence collection.
Revoke tokens, review other credentials, and remove unauthorized consent.
Hunt across the tenant for the same app, mailbox, subject, and attachment patterns.
Investigate other hosts using the DNS domain or a similar query shape.
Determine which files may have left and whether notification is required.
Rebuild the host from a trusted image if integrity cannot be established.
Deploy improved detections and run a tabletop for comparable SaaS C2.

Changing a user password may do nothing when the implant uses a client secret. Removing the application without investigating the host leaves the loader and potentially another channel. The first 72 hours of incident response must bring together endpoint, identity, M365, DNS, legal, and data owners.

Preventing similar channels

Prefer workload identity and certificates over long-lived client secrets where possible.
Restrict application access to specific mailboxes and Graph functions.
Require an owner, expiration date, and review for every application.
Prevent direct DNS from hosts and route it through monitored resolvers.
Retain complete auditing for applications, not only users.
Alert on data placed in distant events and unusual calendar attachments.
Segment administrative hosts and constrain their egress.
Test whether the SOC can connect SaaS, DNS, and EDR alerts.

Zero Trust is more useful here than a one-domain block. Every application request has an identity, scope, device, and context that should be continuously evaluated.

FAQ

Does HOLLOWGRAPH exploit a Microsoft 365 vulnerability?

The published analysis does not describe a Microsoft 365 zero-day. The malware abuses legitimate Graph features and compromised application or account credentials. The security failure is identity compromise followed by malicious use of valid functions.

Does blocking cloudlanecdn[.]com solve the problem?

It is an important IOC but not a complete response. The primary channel uses Microsoft Graph, and the refresh domain can change. Revoke credentials, remove the implant, and hunt across the tenant.

Is every calendar event in 2050 malicious?

No. Legitimate tests or long-term reminders may exist. The date becomes high signal when combined with subject patterns, attachments, application Graph access, and host activity.

The main conclusion

HOLLOWGRAPH bypasses classic bad-domain hunting because its most important traffic uses trusted cloud services. Defense needs service behavior, not only the TLS destination. Calendar, application identity, DNS, and endpoint make one incident even if each team sees only a fragment.

Want to know whether Microsoft 365 could act as an invisible C2 channel in your environment? BreachRoad conducts controlled red-team assessments and identity reviews without using production data. Contact us to plan detection validation.