HollowGraph Malware Hides C2 and Stolen Files in Microsoft 365 Events Dated 2050
A newly discovered espionage implant, HollowGraph, uses a hijacked Microsoft 365 calendar as its command channel, planting operator instructions and smuggling out stolen files as attachments on calendar events dated to the year 2050. The malware is a .NET DLL that support…
Intelligence analysis by Llama
HollowGraph, a .NET DLL, uses a hijacked Microsoft 365 calendar as its command channel, planting operator instructions and smuggling out stolen files as attachments on calendar events dated to the year 2050. The malware supports just two commands, get and send, and it never reaches out to an attacker-owned server for payloads.
Imagine a hacker using a calendar event to send secret instructions to their computer. They hide the instructions in a file attached to the event, and the computer reads the instructions from the file. This is like a secret message in a bottle, but instead of a bottle, it's a calendar event. The hacker uses this method to send instructions to their computer and to steal files from the victim's computer.
Analysis
A Hijacked Calendar as Command Channel
HollowGraph, a .NET DLL, uses a hijacked Microsoft 365 calendar as its command channel, planting operator instructions and smuggling out stolen files as attachments on calendar events dated to the year 2050. This approach moves tasking and stolen data through legitimate Microsoft Graph API traffic, making it hard to spot. The implant is a .NET DLL that supports just two commands, get and send, and it never reaches out to an attacker-owned server for payloads.
Encryption and Key Management
Everything moving through the calendar is wrapped in hybrid RSA and AES-256 encryption, with separate key pairs for incoming tasking and outgoing data. A second, cruder channel keeps that Graph access alive. Over DNS, HollowGraph refreshes the app's Entra ID (Azure AD) login details: its tenant ID, client ID, client secret, and target mailbox. It decodes those values from IPv6 AAAA records sent back by an attacker domain, cloudlanecdn[.]com, then writes them to logAzure.txt, a file dressed up as a routine log.
Attribution and Victim Geography
Group-IB ties HollowGraph to Cavern with high confidence, on shared command syntax and matching internal tasking. Cavern is a modular backdoor framework that Check Point documented earlier this month and attributed to an Iranian Ministry of Intelligence and Security-linked actor it calls Cavern Manticore, a cluster it says overlaps with the known Iranian groups MuddyWater and Lyceum. But the firm link is to the code, not the crew. Group-IB will not name the operator behind this campaign: "Based on the evidence currently available, we cannot confidently attribute this activity to any previously identified threat actor," it wrote, noting only a low-confidence overlap with Lyceum, a subgroup of the Iranian actor OilRig. The compromised exfiltration mailbox belongs to an Israeli organization, but Group-IB treats that as victim geography, not attribution.
Key points
- HollowGraph is a .NET DLL that uses a hijacked Microsoft 365 calendar as its command channel.
- The malware supports just two commands, get and send, and it never reaches out to an attacker-owned server for payloads.
- Everything moving through the calendar is wrapped in hybrid RSA and AES-256 encryption, with separate key pairs for incoming tasking and outgoing data.
- Group-IB ties HollowGraph to Cavern with high confidence, on shared command syntax and matching internal tasking.
- The compromised exfiltration mailbox belongs to an Israeli organization, but Group-IB treats that as victim geography, not attribution.
If this development plays out positively, it could lead to improved security measures for Microsoft 365 users, such as enhanced monitoring and detection capabilities for suspicious calendar activity. This could help prevent future attacks like the one described in this article.
The realistic downside risks or failure modes of this development include the potential for the hacker to adapt and evolve their tactics, making it harder for security measures to keep up. Additionally, the use of legitimate Microsoft services as a command channel could make it harder for security teams to detect and respond to attacks.
