"HOLLOWGRAPH represents an advanced and highly targeted espionage threat," Group-IB wrote.
HOLLOWGRAPH's payload and tradecraft
Researchers at Group-IB say they have uncovered a compact espionage implant they call HOLLOWGRAPH that abandons the normal command-and-control model in favor of hiding inside Microsoft 365 calendars. Rather than contacting attacker-controlled servers, the implant reads tasking from one calendar event, writes stolen files into another, and otherwise limits itself to a small set of behaviors: fetch instructions, stash exfiltrated data, and periodically refresh cloud authentication credentials. Group-IB described the malware as "relatively lean" and tied the observed samples to a known toolset.
Microsoft Graph and calendar abuse
HOLLOWGRAPH does not exploit a flaw in Microsoft 365 or Microsoft Graph; instead, it "wraps its command-and-control traffic inside legitimate Graph API requests that look just like any other Microsoft 365 application talking to the cloud," Group-IB found. The implant places encrypted tasking and stolen files into appointments deliberately dated far into the future — every event it created in the observed campaign was dated May 13, 2050 — a corner of a calendar the researchers say is less likely to attract attention. In effect the malware blends its C2 channel into routine, trusted cloud application traffic.
DNS tunneling and Entra ID credential refresh
To keep its Graph-based communications going, the implant periodically retrieves fresh Entra ID credentials over a DNS tunneling channel. Group-IB noted that this DNS-based refresh mechanism is part of how HOLLOWGRAPH maintains authenticated access to Microsoft 365 services while avoiding direct connections to attacker infrastructure. In the firm's words, "By abusing trusted Microsoft 365 calendars through the Microsoft Graph API and refreshing its cloud authentication credentials through DNS tunneling, the malware conceals its command-and-control within legitimate Microsoft 365 and network traffic, evading conventional perimeter defenses."
Scope, attribution, and the Israeli connection
The campaign observed by Group-IB appears narrowly targeted. The firm identified 12 infected systems, and only three of those systems communicated with the compromised mailbox during the period covered by the investigation. The compromised mailbox used as the drop box belonged to an Israeli organization, and Group-IB said malware samples were uploaded from Israel. Taken together, the researchers concluded the evidence points to a focused espionage operation rather than a broad opportunistic campaign.
On attribution, Group-IB linked HOLLOWGRAPH to the Cavern framework with high confidence after finding matching command formats and implementation details. The researchers also reported similarities with the Iranian-linked espionage group Lyceum, but said that connection is supported at only low confidence.
What this means for technologists, affected enterprises, and defenders in Israel
- Technologists and security teams: watch for Graph API requests that interact with calendar events in unexpected ways and for calendar entries dated May 13, 2050 carrying encrypted attachments. Also monitor for DNS tunneling activity that could be used to refresh Entra ID credentials, since Group-IB observed that as part of the implant's operational model.
- Affected enterprises using Microsoft 365: the campaign highlights that trusted services can be repurposed as covert channels; organizations that rely on cloud calendars should include calendar objects in threat-hunting and incident-response playbooks when investigating suspicious access to tenant workloads.
- Defenders in Israel: because the compromised mailbox belonged to an Israeli organization and samples were uploaded from Israel, local investigators and responders may have a particular interest in tracing the operation's targets and containment paths within the observed environment.
Conclusion
HOLLOWGRAPH illustrates a simple but effective pivot: using Microsoft 365 calendars as a discrete, authenticated rendezvous for commands and exfiltrated data, while renewing cloud credentials over DNS to avoid direct attacker infrastructure. Group-IB's snapshot — 12 infected systems, three communicating with the mailbox, an Israeli mailbox used as the drop site, a Cavern link with high confidence and a low-confidence Lyceum resemblance — paints the picture of a surgical espionage effort rather than a scattershot campaign. The particulars leave a concrete open question for defenders: if a small, lean implant can hide its life cycle inside routine Graph API calls and a far-future calendar date, how many similar operations could be operating unnoticed within trusted cloud services?
