“The relatively small number of identified victims suggests that the operation is highly targeted rather than opportunistic,” Group-IB researchers wrote in a July 20 post.
What HollowGraph is and how it hides inside trusted services
Group-IB identified a newly discovered Windows malware sample it named HollowGraph that abuses the Microsoft Graph API to turn a compromised Microsoft 365 calendar into a covert, two‑way command‑and‑control (C2) channel. The malware never reaches out to attacker‑owned servers for payload delivery; instead, it relies on trusted third‑party infrastructure — Microsoft 365 calendars accessed through Graph — to carry both instructions and stolen data.
Two commands, a calendar as a mailbox for malware
HollowGraph supports two explicit commands: get and send. The send command generates calendar appointments with encrypted stolen files attached. The get command searches for appointments planted by the operator and downloads attached instructions. Because appointments and attachments are normal parts of mailbox activity, the traffic is designed to look like routine Microsoft 365 operations unless defenders specifically hunt for it.
Authentication, encryption and an unencrypted DNS channel
Group-IB reported that HollowGraph uses a hybrid cryptographic scheme: RSA plus AES‑256‑GCM to secure communications over the Graph channel, and it uses distinct RSA key pairs for each direction (inbound versus outbound). To obtain and refresh Microsoft Entra ID (Azure AD) credentials needed to authenticate to the Graph channel, HollowGraph uses DNS tunneling. Group-IB noted that the DNS channel used to deliver and refresh those credentials “is not encrypted.”
Technical ties to the Cavern framework
Researchers at Group-IB attributed the sample, with high confidence, to the Cavern backdoor framework and assessed HollowGraph is part of a different variant of that toolkit. The evidence includes a matching command invocation string — formatted as <command>_;;_<arg0>_,_<arg1>_,_<arg2> — and an observed tasking JSON structure that mirrors Cavern’s C2 format (for example: {{“cid”: “oXhLaJ0ZvtPb9XB”, “type”: “self”, “cmd”: “003_;;__,_”}}). Group-IB also pointed to specific issued commands such as MzU=, which decodes to 003, characterized as a Toggle debug logging instruction and classified as an agent self command in Cavern.
Targeting, scope and timeline
Group-IB’s analysis shows the operation is highly targeted and focused on Israeli entities. The firm reported that the single compromised mailbox it identified was associated with an Israeli organization; the malware files it observed were uploaded from Israel; and files tied to the broader Cavern framework were likewise uploaded from Israel. Group-IB identified 12 infected systems in total. The earliest observed victim–attacker communication took place on June 3, 2026; the most recent example the researchers cited was July 9, 2026.
What this means for Microsoft 365 security teams, Israeli organizations, and threat hunters
- Microsoft 365 security teams: Monitor Microsoft Graph API activity and Microsoft 365 mailbox audit logs for anomalous calendar operations, including event creation, attachment uploads, and subject changes when those operations are performed by an application rather than an interactive user.
- Israeli organizations: Prioritize mailbox auditing and hunting specifically for app‑driven calendar events and unexpected calendar attachments, given the narrow targeting Group‑IB reported.
- Threat hunters and incident responders: Hunt for Cavern‑style command formats and indicators such as the specific command syntax and the MzU= (003) toggle; look for DNS tunneling activity used to deliver or refresh Microsoft Entra ID (Azure AD) credentials.
Group-IB’s findings underscore a simple but consequential point: adversaries can turn the very services organizations trust for collaboration into conduits for covert C2 and data exfiltration. The firm’s practical recommendation — continuous hunting for the indicators associated with HollowGraph and closer monitoring of Graph and mailbox audit activity for application‑driven calendar changes — is both narrow and urgent, matching the small, targeted footprint Group‑IB observed.
Read the original report: https://www.infosecurity-magazine.com/news/hollowgraph-microsoft-calendars/
