"The mailbox calendar [is] a “covert dead-drop,” Group-IB says.
How HollowGraph turns Microsoft 365 calendars into a C2 channel
Researchers at Group-IB describe a malicious module they call HollowGraph that weaponizes the calendar feature of compromised Microsoft 365 mailboxes to receive commands and to exfiltrate data. The malware creates calendar events dated May 13, 2050, using narrowly formatted titles and attaches files that contain either instructions from the attacker or stolen, encrypted data. HollowGraph polls those entries in a fixed one-hour window between 22:00 and 23:00 UTC on that date, using the mailbox calendar as the covert conduit for inbound and outbound traffic.
Command set and operational behavior
Group-IB’s analysis found HollowGraph implements a deliberately small command surface: two operations named GET and SEND. The GET command searches for entries titled in the pattern "Event ID: <7-char-taskID>" and downloads and decrypts the received instructions. The SEND command creates calendar entries formatted as "Boss{{..}}ID{{..}}" and attaches stolen files encrypted with the malware’s public RSA key. By limiting itself to calendar entries and attachments, HollowGraph aims to blend malicious activity into ordinary mailbox artifacts.
Authentication, encryption and DNS tunnelling
HollowGraph authenticates to Microsoft Graph using hardcoded Microsoft Entra ID credentials stored in a configuration file named logAzure.txt. That file contains the Microsoft Entra tenant ID, application (client) ID, client secret, the target mailbox address, a command-and-control domain, and two RSA keys. Group-IB says the two cryptographic keys are used separately — one to encrypt files before delivery to the attacker and the other to decrypt incoming tasks — and that the malware uses a hybrid scheme mixing RSA and AES-256-GCM to keep inbound and outbound channels cryptographically separated.
The malware also includes an alternate, unencrypted channel: DNS tunnelling. HollowGraph retrieves new Microsoft Entra ID details (tenantId, clientId, clientSecret, and mailbox) from IPv6 AAAA record queries to an attacker-controlled domain, cloudlanecdn[.]com. As Group-IB explains, “Each returned IPv6 address (16 bytes) yields 14 usable payload bytes.” HollowGraph assembles 14-byte chunks from successive AAAA responses, decodes them as UTF-8, and writes the resultant values into logAzure.txt.
Observed infections, targeting and attribution
Group-IB reports at least 12 systems infected with HollowGraph; three of those systems were actively communicating with the threat actor between June 3 and July 9. The indicators collected by the researchers point to a focus on organizations in Israel, leading Group-IB to characterize the activity as a targeted espionage campaign. Technically, the researchers link HollowGraph with high confidence to the Cavern command-and-control framework. They also note several technical similarities with the Iranian-nexus threat actor Lyceum, but say the evidence is insufficient to attribute the activity to Lyceum with high confidence.
Detection and mitigation guidance recommended by Group-IB
- Monitor Microsoft Graph and Microsoft 365 audit logs for suspicious, application-driven calendar activity — especially events scheduled far in the future, and entries with unusual subjects or attachments.
- Look for specific indicators such as the domain cloudlanecdn[.]com and the presence of a configuration file named logAzure.txt.
- Enforce Conditional Access controls, restrict and audit OAuth client-credential applications, and monitor outbound DNS traffic for tunnelling patterns consistent with IPv6 AAAA-based exfiltration.
What this means for technologists and for organizations in Israel
Technologists and security teams should treat application-driven calendar writes and calendar attachments as a potential covert channel and include those events in log collection and EDR rules. Monitoring for OAuth client-credential activity and guarding keys and client secrets stored in files such as logAzure.txt becomes critical when attackers can refresh credentials via DNS. For organizations in Israel — singled out by the indicators collected — the combination of mailbox abuse and DNS tunnelling raises the likelihood the activity is espionage-focused and warrants prioritized review of Microsoft 365 audit trails.
HollowGraph illustrates an evolving pattern: adversaries combining legitimate cloud APIs and email/calendar features with out-of-band channels to evade detection. Group-IB’s linkage to the Cavern framework and the observed operational details provide concrete detection hooks — cloudlanecdn[.]com, logAzure.txt, far-future calendar entries between 22:00–23:00 UTC on May 13, 2050, and anomalous AAAA lookups — that defenders can and should instrument now.
