HollowGraph Malware Turns Microsoft 365 Calendars Into a Hidden Espionage Channel

A newly identified cyber espionage malware is turning an everyday Microsoft 365 calendar into a covert command-and-control system.

Researchers have uncovered a .NET-based implant called HollowGraph that uses compromised Microsoft 365 accounts and the Microsoft Graph API to receive instructions and exfiltrate stolen files. Instead of connecting directly to an attacker-controlled server, the malware hides its activity inside legitimate calendar operations.

The most unusual part of the campaign is where the attackers hide their communications: calendar events scheduled decades into the future.

According to research from Group-IB, HollowGraph creates and searches for Microsoft 365 calendar events dated May 13, 2050. These events act as a hidden mailbox between the malware and its operators.

The technique allows attackers to move commands and stolen information through legitimate Microsoft cloud infrastructure, making the activity significantly harder to distinguish from normal business traffic.

This is another example of a broader trend in modern cyber espionage: attackers are increasingly abusing trusted cloud platforms, rather than relying exclusively on dedicated command-and-control servers.

HollowGraph Turns a Microsoft 365 Calendar Into a Dead Drop

The malware is delivered as a .NET DLL and reportedly contains a relatively small number of core functions. Its primary operations are represented by two commands: get and send.

The simplicity of the command structure does not reflect the sophistication of the communication mechanism.

HollowGraph uses the calendar associated with a compromised Microsoft 365 mailbox as a two-way dead drop. In intelligence operations, a dead drop is a location where information can be deposited and retrieved without requiring the participants to communicate directly.

In this case, the dead drop is a Microsoft 365 calendar.

The attackers create a specially crafted calendar event. HollowGraph periodically queries the calendar through the Microsoft Graph API, searches for the expected event and retrieves the attached instructions.

The event is dated 2050–05–13.

That date is unlikely to attract attention from a normal user browsing their calendar. It also gives the attackers a predictable location where commands can be placed without creating obvious suspicious network connections.

The malware reads the instructions from an attached file and executes the requested operation.

The process works in the opposite direction when the attackers want to steal information.

HollowGraph collects a file from the compromised computer, encrypts it, creates a new calendar event scheduled far into the future and uploads the stolen information as an attachment.

The attacker can then retrieve the data through the same Microsoft 365 infrastructure.

There is no traditional attacker-controlled web server receiving a large file transfer. Instead, the stolen data appears to be moving through ordinary Microsoft Graph API activity.

That is the central advantage of the technique.

The Malware Uses Hybrid RSA and AES-256 Encryption

The data exchanged through the calendar is protected using a combination of RSA and AES-256 encryption.

According to Group-IB's analysis, HollowGraph uses separate cryptographic key pairs for incoming commands and outgoing stolen data.

This creates two separate protected communication paths.

The malware receives encrypted instructions from the attackers through calendar attachments. When it needs to exfiltrate information, it encrypts the stolen file before uploading it to another specially created calendar event.

The use of strong encryption means that simply monitoring the content of Microsoft 365 traffic is unlikely to reveal the actual commands or stolen information.

From a network perspective, defenders may see legitimate communication with Microsoft cloud infrastructure.

The real challenge is therefore not only inspecting the network connection. It is understanding who is using the Microsoft Graph API, which application is making the requests and what actions are being performed inside the tenant.

A calendar application creating events and uploading attachments may be completely legitimate.

The same behavior performed by a newly created OAuth application, from an unusual host, at unusual times and against a mailbox that normally has no automated calendar activity, is much more suspicious.

A Second Channel Uses DNS to Maintain Access

HollowGraph also uses another communication mechanism to obtain or refresh the Microsoft 365 credentials required to access the compromised mailbox.

The malware retrieves configuration information through DNS queries.

The information includes details such as:

• the Microsoft Entra ID tenant ID;
• the application client ID;
• the client secret;
• the target mailbox.

The data is encoded into IPv6 AAAA DNS records returned by an attacker-controlled domain.

The malware then decodes the information and stores it locally in a file named logAzure.txt.

The filename is designed to appear harmless and resemble an ordinary Microsoft Azure-related log file.

The DNS component is particularly interesting because it provides a way for the attackers to update or refresh the credentials used by the malware without relying on the same communication channel used for command execution and data theft.

The calendar channel is used for tasking and exfiltration.

DNS is used to retrieve the information needed to maintain access to the Microsoft cloud environment.

This separation makes the malware more flexible and complicates detection.

The domain identified in the investigation is:

cloudlanecdn[.]com

As with any indicator of compromise, defenders should not rely exclusively on the domain. Attackers can change infrastructure relatively quickly.

The behavioral indicators are more valuable over the long term.

The Attack Does Not Exploit a Microsoft 365 Vulnerability

One of the most important aspects of the HollowGraph campaign is that it does not appear to exploit a vulnerability in Microsoft 365 or Microsoft Graph.

The malware is abusing legitimate functionality.

This distinction is critical.

There is no Microsoft security patch that will eliminate the technique. The attackers are using valid cloud functionality with compromised credentials and application permissions.

The problem is therefore primarily one of identity security, OAuth governance and cloud monitoring.

If an attacker obtains the credentials necessary to authenticate an application to Microsoft Graph, the activity can potentially look like normal API traffic.

This is why cloud identity has become such an important component of modern enterprise security.

The attack surface is no longer limited to endpoints, servers and network appliances. It also includes:

OAuth applications, client secrets, service principals, delegated permissions, Microsoft Graph API access and cloud mailboxes.

A compromised application with excessive permissions can provide an attacker with access to sensitive data without requiring the installation of a traditional malware component on every system.

HollowGraph demonstrates how that access can then be used as a covert communication channel.

The 2050 Calendar Event Is the Most Valuable Detection Signal

Group-IB identified several unusual indicators that can help security teams search for the campaign.

The most obvious is the use of calendar events dated to May 13, 2050.

Defenders should investigate events with that date, particularly when they contain other suspicious characteristics.

Potentially relevant indicators include calendar events with:

• the date 2050–05–13;
• a subject consisting of a bare GUID;
• naming patterns such as Event ID:;
• names matching the format Boss{..}ID{..};
• attachments named File{n}.txt.

None of these indicators should automatically be considered malicious in isolation.

A calendar event scheduled in 2050 could theoretically have a legitimate explanation.

However, a combination of a far-future date, an unusual GUID-style subject and an attachment created by an application rather than a human user should receive immediate investigation.

The broader lesson is that calendar data needs to become part of cloud threat hunting.

Many organizations monitor email, authentication logs and file storage activity.

Calendar activity often receives much less attention.

That creates an opportunity for attackers.

Monitoring Microsoft Graph API Activity Is Becoming Essential

The HollowGraph campaign demonstrates why monitoring Microsoft Graph API activity is increasingly important.

Security teams should pay particular attention to applications that perform unusual operations such as:

• creating calendar events;
• modifying existing events;
• uploading attachments;
• renaming event subjects;
• accessing mailboxes through application credentials;
• performing repeated automated actions against a small number of user accounts.

The identity behind the action is just as important as the action itself.

An application that has existed for years and performs normal calendar synchronization may not be suspicious.

A newly registered application with a recently created client secret that suddenly begins creating calendar events and uploading encrypted attachments is a different situation.

Organizations should also audit OAuth applications with access to Microsoft Graph.

The following questions are particularly important:

Which applications can access calendars?

Which applications can access mailbox data?

Which applications use client credentials rather than interactive user authentication?

When were their client secrets created?

Who approved the permissions?

Are those permissions still necessary?

A large number of organizations have accumulated old service principals, third-party applications and unused OAuth permissions over time.

Each one can become an attractive target for attackers.

Group-IB Links HollowGraph to the Cavern Malware Framework

Group-IB has identified a strong technical relationship between HollowGraph and a backdoor framework known as Cavern.

The connection is based on similarities in internal command syntax and tasking mechanisms.

However, the researchers have been careful not to overstate attribution.

Group-IB has not confidently attributed the HollowGraph campaign to a specific threat actor.

The company noted a low-confidence overlap with Lyceum, an Iranian-linked threat group associated with the broader OilRig ecosystem, but said the available evidence is insufficient to definitively identify the operator.

The distinction is important.

Attribution in cyber espionage investigations is often based on a combination of technical evidence, infrastructure, malware development patterns, victimology and operational behavior.

A connection between two malware families does not automatically prove that the same group operated both campaigns.

In this case, the evidence strongly suggests a relationship between the malware and the Cavern framework.

The identity of the operator remains less certain.

The Campaign Appears Targeted Rather Than Opportunistic

Group-IB reportedly identified HollowGraph on at least 12 machines.

Only around three of those systems were actively communicating with the attackers during the analysis period.

The observed activity occurred between June 3 and July 9, 2026.

The relatively small number of infected systems suggests that the campaign may be focused on targeted espionage rather than mass malware distribution.

The victim organization associated with the exfiltration mailbox was located in Israel.

However, researchers have emphasized that the location of a victim should not automatically be used to determine who is behind an operation.

The limited number of observed infections does not necessarily mean that the technique is limited.

Once attackers have developed a working method for abusing Microsoft Graph, the same concept could potentially be adapted to other organizations and other Microsoft 365 services.

The underlying idea is highly reusable.

An attacker does not necessarily need to build a dedicated command server.

They can use the victim's own cloud environment as a communications platform.

Cloud Services Are Becoming the New Command-and-Control Infrastructure

The use of legitimate cloud platforms for command and control is not new.

Attackers have previously hidden communications inside:

• email inboxes;
• email drafts;
• cloud storage;
• collaboration platforms;
• public code repositories;
• social media;
• messaging services.

HollowGraph shows how this trend is expanding into calendar systems.

The advantage is clear.

Traditional network defenses often focus on detecting connections to known malicious IP addresses, domains and unusual protocols.

But if malware communicates with Microsoft Graph, the traffic is directed toward legitimate Microsoft infrastructure.

Blocking Microsoft 365 is obviously not a realistic option for most organizations.

The problem therefore shifts from simple network blocking to behavioral detection.

The question is no longer:

Is this computer communicating with a malicious server?

It becomes:

Is this application performing a legitimate Microsoft Graph operation in an abnormal way?

That is a much more difficult security problem.

What Security Teams Should Look For

Organizations using Microsoft 365 should consider hunting for the following behaviors.

First, search for calendar events scheduled decades in the future, especially events dated May 13, 2050.

Second, investigate event subjects containing GUIDs or unusual command-like naming patterns.

Third, look for attachments with names such as File1.txt, File2.txt and similar sequential formats.

Fourth, audit applications that create or modify calendar events using Microsoft Graph.

Fifth, investigate recently created client secrets associated with applications that have access to mailboxes or calendars.

Sixth, monitor for unusual DNS activity involving repeated AAAA queries and long, high-entropy subdomains.

Finally, search endpoints for suspicious files such as logAzure.txt and investigate any systems where the file appears alongside unusual .NET DLL activity.

The indicators associated with a single campaign may eventually become obsolete.

The behaviors are likely to remain relevant.

Identity Security Is Now Endpoint Security

The HollowGraph campaign illustrates an important change in the way modern attacks work.

A compromised endpoint may be the initial point of access.

But the attacker may then move into the cloud identity layer.

Once there, the attacker can abuse legitimate APIs to access data and communicate with malware without necessarily maintaining a traditional external command server.

This means that endpoint protection alone is not enough.

Organizations need a security model that connects:

Endpoint telemetry.

Entra ID identity events.

OAuth application activity.

Microsoft Graph API logs.

Mailbox and calendar activity.

DNS monitoring.

When these data sources are analyzed separately, HollowGraph-like activity can appear relatively normal.

A .NET process on a Windows computer may not be enough to trigger an alert.

A Microsoft Graph request may not be enough.

A calendar event may not be enough.

A DNS query may not be enough.

But when the same user account, application or endpoint performs all of these actions together, the picture changes significantly.

That is where behavioral detection becomes powerful.

HollowGraph Shows Why Defenders Need to Look Where Nobody Usually Looks

The idea behind HollowGraph is simple but effective.

Instead of building a suspicious communication channel, the attackers used something that organizations already trust.

Instead of sending stolen files to an obvious external server, the malware uploaded them as calendar attachments.

Instead of placing commands in a traditional C2 response, the attackers hid them in events scheduled for 2050.

The technique works precisely because calendars are usually considered harmless.

Security teams inspect email.

They inspect authentication.

They inspect file downloads.

But a calendar event created by an application may not attract the same attention.

That assumption is becoming dangerous.

The growing abuse of cloud services shows that the next generation of espionage malware may not need to communicate with infrastructure that looks malicious.

It may simply communicate with the services an organization already uses every day.

For defenders, the most important lesson from HollowGraph is therefore not just to search for one malware name or one suspicious date.

It is to understand how legitimate cloud functionality can be transformed into a covert command-and-control system.

A calendar event scheduled for 2050 may be nothing.

Or it may be the only visible trace of an attacker controlling a compromised network.

In modern cloud environments, the most dangerous traffic may not be the traffic that looks malicious. It may be the traffic that looks completely normal.

Frequently Asked Questions About HollowGraph Malware

What is HollowGraph malware?

HollowGraph is a .NET-based cyber espionage malware that abuses Microsoft 365 and the Microsoft Graph API to receive commands and exfiltrate stolen files. Instead of using a traditional attacker-controlled command-and-control server, the malware uses a compromised Microsoft 365 calendar as a covert communication channel.

How does HollowGraph use Microsoft 365 calendars?

HollowGraph uses calendar events as a hidden command-and-control mechanism. Attackers can create specially crafted events containing instructions, while the malware can create other events and upload stolen files as attachments.

The campaign reportedly uses calendar events scheduled for May 13, 2050, making them unlikely to be noticed during normal calendar use.

Why are HollowGraph calendar events dated to 2050?

The use of a far-future date is a concealment technique. A calendar event scheduled for 2050 is unlikely to be viewed by the account owner during normal business activity. This allows attackers to use the calendar as a hidden storage location for commands and stolen data.

Does HollowGraph exploit a Microsoft 365 vulnerability?

No. The campaign does not rely on a known Microsoft 365 software vulnerability. HollowGraph abuses legitimate Microsoft Graph API functionality through compromised accounts, credentials or application permissions.

This means that installing a software patch alone is not enough to stop the technique.

What information can HollowGraph steal?

The malware is designed to exfiltrate files from compromised systems. The stolen data is encrypted and uploaded as attachments to specially created Microsoft 365 calendar events.

The exact information stolen depends on the commands issued by the attackers.

How does HollowGraph communicate with its operators?

HollowGraph primarily communicates through Microsoft Graph API activity associated with a compromised Microsoft 365 mailbox.

The malware can retrieve commands from calendar event attachments and upload stolen files to new calendar events.

It also uses DNS-based communication to retrieve configuration data related to Microsoft Entra ID applications and Microsoft 365 access.

What encryption does HollowGraph use?

The malware uses a combination of RSA and AES-256 encryption to protect communications and stolen files.

Separate cryptographic mechanisms are used for incoming commands and outgoing data.

What are the main indicators of a HollowGraph infection?

Security teams should investigate:

• Calendar events dated May 13, 2050.
• Events with subjects consisting of unusual GUIDs.
• Subjects containing patterns such as Event ID: or Boss{..}ID{..}.
• Attachments named File{n}.txt.
• Unexpected applications creating calendar events through Microsoft Graph.
• Newly created Microsoft Entra ID client secrets.
• Suspicious DNS queries involving repeated IPv6 AAAA records.
• The presence of a file named logAzure.txt in suspicious circumstances.

These indicators should be investigated together because individual indicators may also have legitimate explanations.

Is HollowGraph connected to the Cavern malware framework?

Group-IB has identified a strong technical connection between HollowGraph and the Cavern malware framework, based on similarities in command syntax and tasking mechanisms.

However, the identity of the threat actor behind the specific HollowGraph campaign has not been conclusively established.

Who is behind the HollowGraph campaign?

The campaign has not been definitively attributed to a specific threat actor.

Researchers have noted possible technical overlaps with Iranian-linked activity, including a low-confidence connection to Lyceum, but the available evidence is not sufficient to confirm the identity of the operators.

How can organizations defend against HollowGraph?

Organizations should focus on cloud identity security and Microsoft Graph monitoring.

Recommended measures include auditing OAuth applications, reviewing Microsoft Entra ID client credentials, limiting unnecessary Graph API permissions, monitoring automated calendar activity and investigating unusual application-driven creation of calendar events and attachments.

Organizations should also use Conditional Access, rotate exposed credentials and client secrets, and monitor for anomalous access to Microsoft 365 resources.

Can antivirus software detect HollowGraph?

Traditional antivirus protection may detect the malware file itself, but endpoint detection alone may not be sufficient.

Because HollowGraph abuses legitimate Microsoft 365 services, defenders should combine endpoint telemetry with Microsoft Graph API monitoring, Entra ID logs, DNS monitoring and cloud activity analysis.

Is using Microsoft Graph API dangerous?

No. Microsoft Graph API is a legitimate Microsoft platform used by thousands of applications and organizations.

The security risk comes from compromised credentials, excessive application permissions or malicious applications abusing legitimate Graph functionality.

The important question is not whether Graph API is being used, but which application is using it, which account authorized it and what actions it is performing.

What is the main lesson from the HollowGraph campaign?

The main lesson is that cyber attackers can hide inside legitimate cloud services.

A Microsoft 365 calendar can become a covert command-and-control channel. A normal API request can carry malicious instructions. A calendar attachment can contain stolen data.

For this reason, modern cybersecurity requires monitoring not only suspicious connections, but also unusual behavior inside trusted cloud platforms.

Source: https://thehackernews.com/2026/07/hollowgraph-malware-hides-c2-and-stolen.html