HOLLOWGRAPH malware turns Microsoft 365 calendars into an espionage channel

1. Executive summary

Group-IB has disclosed HOLLOWGRAPH, a targeted espionage implant that uses compromised Microsoft 365 mailboxes as a command-and-control (C2) channel via the Microsoft Graph API. The malware hides operator tasking and exfiltrated files inside calendar events dated 13 May 2050, and refreshes its Entra ID (Azure AD) credentials through DNS tunneling over IPv6 lookups. Group-IB links the malware to the Cavern backdoor framework with high confidence and notes low-confidence technical overlaps with the Iran-linked actor Lyceum; however, the verified reference data carries no MITRE ATT&CK profile for "Iranian espionage activity," so attribution remains unconfirmed. The campaign is narrowly targeted — 12 infected systems identified, 3 active — with all observed victims and infrastructure in Israel, and activity from 3 June to 9 July 2026. EMEA financial services should treat this as a demonstration of a viable, low-noise C2 technique against Microsoft 365 tenants that could be repurposed against any organisation with broad Graph API permissions.

2. Regulatory framing

No specific NIS2 or UK NIS article is directly engaged by the distinctive facts of this item beyond general incident-management obligations that apply to any threat advisory.

3. Technical analysis & attack chain

Attribution caveat: Group-IB links HOLLOWGRAPH to the Cavern backdoor framework with high confidence based on matching command formats and implementation details. The firm notes technical similarities with the Iran-linked actor Lyceum but assesses that link at low confidence only. The verified reference data supplies no MITRE ATT&CK profile for "Iranian espionage activity," so all state-actor attribution is treated as unconfirmed. The following analysis relies on Group-IB's reporting as corroborated by The Register, BleepingComputer, and The Hacker News; the underlying technical detail is single-sourced to Group-IB's research.

Attack chain (confirmed steps)

1. Initial access / mailbox compromise — The attacker gains access to a Microsoft 365 mailbox (the observed C2 mailbox belonged to an Israeli organisation). The specific initial-access vector is not described in the source material. HOLLOWGRAPH does not exploit a vulnerability in Microsoft 365 or Microsoft Graph; it operates using valid credentials and trusted API calls.
2. Credential persistence via DNS tunneling — The implant periodically refreshes its Microsoft Entra ID (Azure AD) credentials needed for Graph API access. It does this by sending IPv6 DNS lookups to an attacker-controlled domain. Updated credential values are saved to a file on disk disguised as a log file. (Specific file path not provided in sources.)
3. C2 via Microsoft Graph API calendar events — HOLLOWGRAPH authenticates to the Microsoft Graph API using the compromised/refreshed Entra ID credentials. It supports two commands only: - get — retrieves operator instructions. The attacker creates a calendar event with an encrypted payload attached as a file. The malware polls for these events, reads the attachment, and extracts the tasking. - send — exfiltrates stolen files. The malware creates a new calendar event, attaches the encrypted stolen files, and saves the event for the operator to collect later.
4. Calendar event concealment — Every calendar event created or read by HOLLOWGRAPH is dated 13 May 2050, placing payloads in a far-future date range unlikely to be noticed by the mailbox owner. Calendar event subject lines follow a pattern containing Event ID: (full pattern not fully specified in the available source material).
5. Encryption — All calendar traffic is encrypted with separate keys for incoming instructions and outgoing files, so compromise of one direction does not expose the other.
6. Observed scope — Group-IB identified 12 infected systems; only 3 communicated with the compromised mailbox during the observation window. Earliest recorded victim contact: 3 June 2026. Most recent: 9 July 2026. All victims and the C2 mailbox are Israeli. The campaign is assessed as a focused espionage operation, not a broad campaign.

Key technical characteristics

4. Mitigation & containment

P1 — Within 24 hours

• Hunt for calendar-event C2 in existing tenants: Query Microsoft Graph / Exchange audit logs for calendar events dated 13 May 2050. In Microsoft Graph PowerShell: powershell Get-MgUserEvent -UserId <user> -Filter "start/dateTime eq '2050-05-13T00:00:00'" Alternatively query via Graph API: GET /users/{id}/events?$filter=start/dateTime eq '2050-05-13T00:00:00' Flag any events with subject lines containing Event ID: for investigation.
• Audit OAuth2 applications with Graph API calendar permissions: Review all Entra ID enterprise applications and app registrations holding Calendars.Read, Calendars.ReadWrite, Calendars.Read.Shared, or Calendars.ReadWrite.Shared Microsoft Graph delegated or application permissions. Revoke any that are unrecognised, unused, or overly broad.
• Alert on new client secret creation: Configure Entra ID alerts for new client secrets on service principals and app registrations, as recommended by Group-IB. This is the mechanism by which HOLLOWGRAPH's credential refresh would persist access.

P2 — Within 72 hours

• Deploy Conditional Access policies restricting Graph API access: Limit Microsoft Graph API access to compliant devices, trusted locations, or specific application client IDs. Block legacy authentication. Require MFA for all interactive Graph API calls where feasible.
• Hunt for DNS tunneling indicators: The malware uses IPv6 DNS lookups to an attacker-controlled domain for credential refresh. Review DNS logs for unusual volumes of AAAA record queries to infrequently-seen or newly-registered domains, especially from endpoints that also show Microsoft Graph API activity. (Specific attacker-controlled domain IOCs were not available in the source material — single-sourced to Group-IB's full blog post.)
• Review on-disk log-disguised credential files: Search endpoints for recently created files with .log extensions in unusual locations that contain token-like or base64-encoded strings consistent with Entra ID access/refresh tokens. (Specific file path not provided in sources.)
• Restrict and audit client-credentials OAuth2 flows: As recommended by Group-IB, evaluate whether client-credentials grant flows are necessary for all current integrations. Prefer managed identities or certificate-based authentication over client secrets where the platform supports it.

P3 — Within 7 days

• Implement credential rotation for service principals: Rotate all client secrets and certificates for service principals with Graph API permissions. Document a rotation schedule.
• Configure CASB / Defender for Cloud Apps anomaly detection: Ensure policies are in place to alert on unusual calendar event creation patterns, including events with future dates beyond a reasonable threshold (e.g., > 2 years), events created by non-interactive accounts, or bulk event creation.
• Validate EDR coverage for DNS tunneling: Confirm endpoint detection tools are configured to flag DNS tunneling behaviours, particularly AAAA-record-heavy traffic to single domains.

5. Indicators of compromise

The source material describes behavioural indicators and partial atomic indicators. Group-IB's full blog post (referenced but not fully provided) is stated to contain additional IOCs — the indicators below are single-sourced to Group-IB via the available source articles.

Behavioural indicators

No complete set of atomic IOCs (domains, IPs, file hashes, file paths) was available in the provided source material. Group-IB's full blog post is referenced as containing additional IOCs — retrieve and validate before enforcement.

6. Detection

rule HOLLOWGRAPH_Calendar_C2_Implant {
    meta:
        author = "Adverse Trace"
        date = "2026-07-20"
        reference = "https://www.helpnetsecurity.com/2026/07/20/hollowgraph-malware-microsoft-365-calendar/"
        description = "Detects HOLLOWGRAPH implant strings: calendar-event C2 commands and event subject pattern"
    strings:
        $cmd_get = "get" ascii
        $cmd_send = "send" ascii
        $event_id = "Event ID:" ascii
        $date_2050 = "2050-05-13" ascii
        $date_2050_alt = "13 May 2050" ascii
    condition:
        ($cmd_get and $cmd_send) and ($event_id or $date_2050 or $date_2050_alt)
}

title: HOLLOWGRAPH Calendar Event C2 - Events Dated 2050
id: 7a3c1f2e-4b5d-4a8e-9c1f-0a6b2c3d4e5f
status: experimental
description: Detects Microsoft 365 calendar events dated 13 May 2050, consistent with HOLLOWGRAPH C2 behaviour
references:

    - https://www.helpnetsecurity.com/2026/07/20/hollowgraph-malware-microsoft-365-calendar/
    - https://www.theregister.com/security/2026/07/20/microsoft-365-calendars-become-spy-drop-boxes-in-hollowgraph-campaign/5274982
author: Adverse Trace
date: 2026/07/20
tags:

    - attack.command_and_control
    - attack.t1071
logsource:
    product: microsoft365
    service: exchange
detection:
    selection:
        event_type: CalendarEventCreated
        start_date: "2050-05-13T00:00:00"
    filter_legitimate:
        user_agent|contains:

            - "Microsoft Outlook"
            - "OutlookWebApp"
    condition: selection and not filter_legitimate
falsepositives:

    - Legitimate long-term calendar reservations (verify with user)
level: high

title: HOLLOWGRAPH DNS Tunneling - High Volume AAAA Queries
id: 8b4d2g3f-5c6e-4b9f-0d2g-1b7c3d4e5f6a
status: experimental
description: Detects high volume of IPv6 DNS lookups to a single domain, consistent with HOLLOWGRAPH credential refresh via DNS tunneling
references:

    - https://www.helpnetsecurity.com/2026/07/20/hollowgraph-malware-microsoft-365-calendar/
author: Adverse Trace
date: 2026/07/20
tags:

    - attack.command_and_control
    - attack.t1071.004
logsource:
    product: dns
detection:
    selection:
        record_type: AAAA
    timeframe: 10m
    condition: selection | count(query_domain) by src_ip > 50
falsepositives:

    - Legitimate IPv6-enabled services with high DNS volume
level: medium

7. Sources

• Help Net Security — "HOLLOWGRAPH malware turns Microsoft 365 calendars into an espionage channel" — https://www.helpnetsecurity.com/2026/07/20/hollowgraph-malware-microsoft-365-calendar/ — 2026-07-20
• The Register — "Microsoft 365 calendars become spy drop boxes in HOLLOWGRAPH campaign" — https://www.theregister.com/security/2026/07/20/microsoft-365-calendars-become-spy-drop-boxes-in-hollowgraph-campaign/5274982 — 2026-07-20
• BleepingComputer — "New HollowGraph malware uses Microsoft Graph for stealthy C2 comms" — https://www.bleepingcomputer.com/news/security/new-hollowgraph-malware-uses-microsoft-graph-for-stealthy-c2-comms/ — 2026-07-20
• The Hacker News — "HollowGraph Malware Hides C2 and Stolen Files in Microsoft 365 Events Dated 2050" — https://thehackernews.com/2026/07/hollowgraph-malware-hides-c2-and-stolen.html — 2026-07-20

8. Adverse Trace position

HOLLOWGRAPH is a narrowly targeted espionage tool, not a broad campaign, and poses no immediate systemic risk to EMEA financial services. However, the technique — abusing Microsoft Graph API calendar events as a C2 channel inside trusted SaaS traffic — is transferable and bypasses network perimeter controls by design. The credential-refresh mechanism via DNS tunneling over IPv6 adds a second evasion layer that many financial services' DNS monitoring may not specifically target. Attribution to Iranian state-sponsored activity is unconfirmed: Group-IB's high-confidence link is to the Cavern framework, and the Lyceum overlap is explicitly low-confidence; the verified reference data carries no MITRE ATT&CK profile for the named actor. All technical detail is single-sourced to Group-IB's research. We assess this as a medium-severity advisory for EMEA financial services: no active exploitation of a vulnerability, no KEV-listed CVE, but a demonstration of a detection gap in SaaS-API-abuse C2 that clients should close proactively. We will monitor for additional IOCs from Group-IB's full report and for any expansion of the victimology beyond Israel.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.