Hackers Use Microsoft 365 Calendar Events as Dead Drops for Malware Commands

A newly identified Windows malware sample, dubbed HOLLOWGRAPH, is abusing the Microsoft Graph API to turn a compromised Microsoft 365 calendar into a covert two-way command-and-control channel.

Group-IB attributes the malware, with high confidence, to the Iranian-linked Cavern backdoor framework, and says it communicates through a compromised Microsoft 365 account in Israel, blending its traffic into legitimate enterprise communications.

HOLLOWGRAPH is a .NET NativeAOT-compiled DLL that supports only two commands: get and send, relying entirely on trusted Microsoft cloud infrastructure rather than attacker-owned servers.

Hackers Use Microsoft 365 Calendar Events

Operators plant instructions by creating calendar events; the implant retrieves and decrypts them via get, while send encrypts stolen files and uploads them as event attachments.

Every event is scheduled far in the future, specifically 13 May 2050, to avoid drawing the mailbox owner’s attention, with stolen data hidden inside attachments named File{n}.txt.

Communications are secured using hybrid RSA-OAEP and AES-256-GCM encryption, with separate RSA key pairs for inbound tasking and outbound exfiltration, keeping the two channels cryptographically independent.

A secondary channel handles authentication maintenance. HOLLOWGRAPH performs DNS tunneling using IPv6 AAAA record queries against the attacker-controlled domain cloudlanecdn[.]com to refresh its Microsoft Entra ID (Azure AD) credentials: tenant ID, client ID, client secret, and target mailbox.

Responses are decoded and written to an on-disk configuration file disguised as a log, logAzure.txt.

Group-IB identified several technical fingerprints tying HOLLOWGRAPH to Cavern, a modular espionage toolkit built from separate plugins that each handle a different task, previously tied to Iran-linked activity.

Matching command syntax and observed C2 tasking, including a base64-encoded “003” command for toggling debug logging, led researchers to assess that HOLLOWGRAPH is part of a different variant of the Cavern framework.

Notably, Cavern itself shares structural similarities with a .NET backdoor previously attributed to Lyceum, a sub-group of the Iranian threat actor OilRig.

Both use modular plugin architectures and a similar plugin-loading mechanism, though Group-IB assesses this potential Lyceum link with only low confidence.

Group-IB identified 12 infected systems, though only about three were actively communicating with attackers during the observation period, suggesting a narrowly targeted espionage operation rather than opportunistic compromise.

The earliest recorded contact between a victim and the attacker dates to June 3, 2026, and the most recent to July 9, 2026, showing the malware has been in active use since at least early June.

Indicators, including the compromised Israeli mailbox and malware samples uploaded from Israel, point to a focused espionage campaign against Israeli entities.

Group-IB urges organizations to hunt for IOCs including the cloudlanecdn[.]com domain and the logAzure.txt configuration file, while monitoring Microsoft Graph API activity and mailbox audit logs for anomalous calendar operations performed by applications rather than users.

Defenders should also watch for calendar artifacts dated 2050-05-13, GUID-only subjects, or naming patterns like Event ID or Boss{..}ID{..}, and audit OAuth2 client-credential applications for new secret creation.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent critical incidents and financial loss with stronger proactive defense. Integrate a live threat feed from 15K SOCs