Security researchers at Group-IB have uncovered a new Windows malware family, dubbed HOLLOWGRAPH, that disguises its command-and-control (C2) communications within legitimate Microsoft 365 calendar events, effectively turning a compromised mailbox into a clandestine dead-drop for attacker commands and stolen data. The technique, first reported on July 20, 2026, marks a significant evolution in abusing trusted cloud platforms, as the malware piggybacks on Microsoft Graph API traffic to blend into normal enterprise network activity, making detection by conventional perimeter defenses exceptionally difficult.

What Happened

Group-IB’s Threat Intelligence team identified HOLLOWGRAPH as a .NET NativeAOT-compiled DLL that is part of a larger modular backdoor framework called Cavern. The malware is narrowly focused: it supports only two commands—get and send—and relies entirely on a compromised Microsoft 365 mailbox for its C2 exchanges. Twelve infected systems were identified, but only about three were actively communicating with the attackers during the observation period. The earliest victim interaction was seen on June 3, 2026, with the latest on July 9, 2026.

All evidence points to a highly targeted espionage operation against Israeli entities. The compromised mailbox used for C2 belongs to an Israeli organization, and the malware samples were uploaded from Israel. This is not a broad, opportunistic campaign; it is a disciplined, narrowly scoped attack.

How the Calendar C2 Works

HOLLOWGRAPH abuses the Microsoft Graph API to treat a compromised user’s calendar as a two-way dead-drop. For the get command, the malware queries the /users/{mailbox}/calendarView endpoint, filtering for events scheduled on May 13, 2050, with subjects containing “Event ID: ” followed by a 7-character task identifier. If found, it downloads the attached File{n}.txt files, decrypts them using an embedded RSA private key and AES-256-GCM, and returns the plaintext instructions to its loader.

For the send command, the implant encrypts data with a separate RSA public key, creates a new calendar event on May 13, 2050, uploads the encrypted data as one or more attachments (e.g., File1.txt), and then renames the event subject to a recognizable tag like Boss{..}ID{..}. All communication flows through standard Microsoft Graph endpoints—POST /users/{mailbox}/calendar/events, POST /users/{mailbox}/events/{event-id}/attachments, and PATCH /users/{mailbox}/events/{event-id}—making it indistinguishable from legitimate application activity to network monitors that trust Microsoft cloud destinations.

This is not a bug in Microsoft 365; it’s a deliberate abuse of supported Graph API features. File attachments on calendar events, programmatic creation, and subject patching are documented and widely used by legitimate automation. HOLLOWGRAPH simply misuses them with stolen credentials.

The DNS Tunnel That Refreshes Access

A second, independent channel ensures the malware can keep its cloud authentication alive. HOLLOWGRAPH performs DNS tunneling over IPv6 AAAA record queries to the attacker-controlled domain cloudlanecdn[.]com to fetch updated Microsoft Entra ID values: tenant ID, client ID, client secret, and target mailbox address. The responses come back in the IPv6 addresses themselves—the first two bytes of a length query encode the expected data size, and subsequent data queries deliver 14-byte payloads per response. These pieces are reassembled and written to a local file named logAzure.txt, which doubles as the implant’s configuration store.

This separation of concerns is deliberate. If defenders revoke a compromised Entra ID application secret, the attacker who can still answer DNS queries can push fresh credentials to the implant, restoring its access to the Microsoft 365 calendar. The Graph traffic is encrypted with a hybrid RSA+ AES-256-GCM scheme, with separate key pairs for inbound tasking and outbound exfiltration, so decrypting one direction does not automatically expose the other.

What It Means for You

For home users, the immediate risk is minimal. HOLLOWGRAPH is not self-propagating malware; it requires a pre-existing compromise to deploy the DLL and already stolen Entra ID credentials to function. However, the technique highlights a dangerous trend: attackers are becoming adept at hiding in plain sight within the very cloud services that many individuals and businesses rely on daily.

For IT administrators and security teams, HOLLOWGRAPH is a wake-up call. Traditional network detection—blocking known bad IPs, inspecting TLS handshakes, or scanning for malicious payloads—will not catch this. The C2 traffic looks like any other Graph API call to graph.microsoft.com. To spot it, you must monitor the behavior of cloud applications, not just their network destinations. Specifically:

  • Microsoft Graph activity logs become your primary sensor. These logs record the application ID, service principal, request URI, and response status for every Graph request. Pivot from unfamiliar Entra ID applications to their actual calendar interactions.
  • Microsoft Purview audit records complement this by logging Exchange actions like calendar event creation, attachment uploads, and subject changes, as well as Entra ID administrative actions such as adding client secrets.
  • Unusual patterns that warrant investigation include: automated access to calendar and attachment endpoints by service principals (not interactive users), events dated far in the future (May 13, 2050), subjects with Event ID: or Boss…ID… formats, and the presence of logAzure.txt on Windows endpoints.

How We Got Here

Abusing trusted cloud platforms for C2 is not new, but HOLLOWGRAPH refines a lineage of techniques that have moved from classic HTTPS beaconing to Google Docs, Dropbox, and now Microsoft 365 calendar operations. In 2022, the UNC3524 group used Microsoft Graph API with a stolen Entra ID application to maintain access. Earlier, actors like OilRig and Lyceum (the Iranian-nexus groups Group-IB notes as having low-confidence ties to this campaign) experimented with modular .NET backdoors and plugin architectures. The Cavern framework itself appears heavily influenced by a Lyceum backdoor observed in early 2025, sharing modular plugin loading and command syntax.

HOLLOWGRAPH’s innovation is the combination of a read-write cloud dead-drop with an out-of-band DNS credential refresh. That dual-channel design makes the implant resilient: even if the calendar C2 is discovered and the mailbox secured, the malware may still be able to receive new configuration and reestablish presence if the DNS infrastructure remains under attacker control.

What to Do Now

If you are responsible for a Microsoft 365 environment, start with these investigative actions:

  • Audit Entra ID applications: Identify any app registrations or enterprise applications that have Calendars.ReadWrite or similar permissions, especially those using client credentials (non-interactive). Look for recently created secrets or certificates.
  • Hunt Graph activity: In the Microsoft Entra admin center or via Log Analytics, query for repeated access to /users/*/calendarView with a startDateTime of 2050-05-13, or rapid sequences of POST /users/*/calendar/events followed by attachment uploads and subject patches. Flag service principals that are not part of known automation.
  • Search mailboxes for artifacts: Use Purview eDiscovery or PowerShell to find calendar events set in 2050, subjects containing “Event ID: ” or “Boss”, and attachments named File1.txt, File2.txt, etc.
  • Check endpoints for logAzure.txt: This file is the implant’s configuration dump. Its presence indicates a host is or was compromised.
  • Monitor DNS traffic: Look for high volumes of AAAA queries to unusual subdomains, particularly those with long random strings or the pattern .p.cloudlanecdn[.]com and .q.cloudlanecdn[.]com. Consider sinkholing the domain cloudlanecdn[.]com.
  • Strengthen credential hygiene: Enforce Conditional Access policies, require multi-factor authentication for all administrative accounts, and implement regular rotation of Entra ID application secrets. Alert on the creation of new credentials outside expected maintenance windows.

If you find evidence of compromise, containment is not just about deleting a strange calendar entry. Revoke the affected application’s secrets, disable the service principal, isolate the host, and reset the compromised mailbox’s credentials. Preserve Graph and audit logs before making destructive changes, and engage your incident response team promptly.

Outlook

HOLLOWGRAPH demonstrates that cloud-hosted C2 is no longer theoretical; it’s a functional, fielded capability. The small victim count and selective engagement suggest the operators are conducting a disciplined espionage campaign, likely focused on intelligence collection from Israeli targets. While the immediate risk to most organizations is low, the tradecraft will almost certainly be copied.

Microsoft continues to enhance Graph activity logging and Purview audit capabilities, but defenders must learn to use these tools effectively. The future of cloud security isn’t just about protecting identities from external theft; it’s also about detecting when those identities—or the applications they empower—behave in ways that don’t match business needs. For now, every security team should ask itself: if an attacker used your own Microsoft 365 environment against you, would you notice?