"Based on the evidence currently available, we cannot confidently attribute this activity to any previously identified threat actor," Group-IB wrote.
How HollowGraph uses Microsoft 365 calendars
Group-IB disclosed a novel espionage implant it named HollowGraph that treats a compromised Microsoft 365 mailbox calendar as a two-way dead drop. The implant is a .NET DLL with only two supported commands — get and send — and it never reaches out to an attacker-owned server for payloads. To receive operator instructions HollowGraph queries the calendar for a specific event buried at the far-future date 2050-05-13 and reads the tasking from an attached file. To exfiltrate data it reverses the flow: encrypts stolen files, creates its own far-future calendar event, and uploads the data as one or more attachments.
Calendar traffic is protected by hybrid RSA and AES-256 encryption, with separate key pairs for incoming tasking and outgoing data. That design lets the malicious traffic ride the legitimate Microsoft Graph API and appear as ordinary Microsoft 365 chatter to network controls keyed to attacker-owned destinations.
A secondary DNS channel and the cloudlanecdn[.]com link
HollowGraph also maintains a cruder out-of-band channel over DNS. The malware refreshes the app's Entra ID (Azure AD) login details — tenant ID, client ID, client secret and target mailbox — by decoding those values from IPv6 AAAA records returned by an attacker domain, cloudlanecdn[.]com. It writes the recovered credentials to a file named logAzure.txt and presents that file as a routine log. Group-IB notes these are stored client-credentials, not access tokens, and unlike the calendar traffic this DNS channel operates in the clear.
Code ties to Cavern, but operator identity remains unresolved
On the code side Group-IB ties HollowGraph to Cavern with high confidence, citing shared command syntax and matching internal tasking. Check Point documented the Cavern backdoor framework earlier this month and attributed it to an actor it calls Cavern Manticore, which the bulletin links to the Iranian Ministry of Intelligence and Security and describes as overlapping with MuddyWater and Lyceum.
Group-IB, however, stresses that the firm linkage is to the codebase rather than to a named crew and declined to assign definitive attribution. The company explicitly treated the compromised exfiltration mailbox — which belongs to an Israeli organization — as victim geography, not proof of operator identity. Group-IB did note a low-confidence overlap with Lyceum, a subgroup of the actor OilRig, but stopped short of a confident attribution.
The implant was observed on at least 12 machines, though only about three were actively communicating with the operator during Group-IB's analysis window; victim traffic ran from 3 June to 9 July 2026.
Detection signals and immediate hunt steps
- Inspect calendars for events dated 2050-05-13; the implant queries that exact date for operator tasking.
- Look for event subjects that are a bare GUID or follow the operator naming pattern Event ID: orBoss{{..}}ID{{..}}.
- Search for attachments named File{{n}}.txt on calendar events.
- Audit Microsoft Graph and mailbox activity for application-driven calendar changes: events created, attachments uploaded, or subjects renamed by an app rather than a person.
- Restrict and audit client-credential OAuth apps that can access Graph, and alert on newly created client secrets. Apply Entra ID hygiene: Conditional Access, credential rotation, and anomalous-token detection.
- Monitor DNS for unusually frequent AAAA queries and long, high-entropy subdomains aimed at a single domain; hunting for cloudlanecdn[.]com and the logAzure.txt file is a fast first pass.
Group-IB says the full indicator set, including file hashes, is available in its report.
What this means for technologists, policymakers, and affected enterprises
- Technologists and security teams: prioritize identity and application-permission controls and monitor application-driven changes to cloud mailboxes and calendars rather than relying solely on network-blocking tactics.
- Policymakers and regulators: recognize that this vector abuses legitimate cloud-provider APIs and that protections will need to focus on OAuth app governance and visibility, not vendor patching cycles.
- Affected enterprises and procurement leaders: audit which client-credential OAuth apps have Graph access, enforce least privilege, and add calendar and mailbox activity to cloud-monitoring plans; far-future calendar entries — like ones dated 2050 — are a concrete, low-noise hunting cue.
There is no Microsoft software vulnerability at the root of this campaign and therefore no patch to deploy. HollowGraph instead rides a compromised account and the Graph API's normal functionality — a design choice that shifts defenders' work from patching to identity controls, app-permission management, and targeted monitoring. With victim traffic observed as recently as 9 July 2026, Group-IB's specific indicators — far-future events, odd GUID-like subjects, File{{n}}.txt attachments, cloudlanecdn[.]com DNS activity and the logAzure.txt artifact — are practical starting points for defenders who need to know where to look now.
