New HollowGraph malware uses Microsoft Graph for stealthy C2 comms
HollowGraph malware uses Microsoft Graph calendar events for C2 comms and data exfiltration.
Summary
A new malware component named HollowGraph is leveraging Microsoft Graph's calendar feature within compromised Microsoft 365 mailboxes for command-and-control (C2) communications and data exfiltration. Researchers link it to the Cavern framework and suspect an Iranian threat actor targeting entities in Israel, with at least 12 systems infected. The malware uses encrypted calendar events for data transfer and DNS tunneling to update its credentials.
Full text
New HollowGraph malware uses Microsoft Graph for stealthy C2 comms By Bill Toulas July 20, 2026 01:43 PM 0 A malicious component dubbed HollowGraph uses the calendar feature in compromised Microsoft 365 mailboxes as a command-and-control channel to receive attacker commands and exfiltrate stolen data. Researchers analysing the module believe it is part of the Cavern command-and-control framework that has been previously linked to an Iranian threat actor targeting entities in Israel. At least 12 systems have been infected with HollowGraph, three of them actively communicating with the threat actor between June 3 and July 9. The collected indicators suggest that the threat actor is focused on organizations in Israel, pointing to a targeted attack for espionage purposes. Microsoft 365 mailbox abuse In a report from cybersecurity company Group-IB, researchers say that HollowGraph uses hardcoded details to authenticate to the Microsoft Graph API via a compromised Microsoft 365 account. The configuration file is stored as logAzure.txt to appear as a regular log file, and "includes the Microsoft Entra ID tenant ID, application (client) ID, client secret, target mailbox address, command-and-control (C2) domain, and two RSA keys." The two cryptographic keys are used to encrypt files before delivery to the attacker and to decrypt incoming tasks. To remain under the radar, the threat actor creates calendar events dated May 13, 2050, with the title in specific formats. Commands and exfiltrated data are concealed within files attached to these calendar entries. According to Group-IB's analysis, HollowGraph supports only two commands that let it create calendar entries with stolen files in encrypted form and search for new ones with instructions from the threat actor: GET, to search for entries in the format "Event ID: <7-char-taskID>," download and decrypt received instructions SEND, to create a calendar entry in the format "Boss{..}ID{..}" and attach stolen data encrypted with the public RSA key The researchers describe the mailbox calendar as a “covert dead-drop,” with HollowGraph retrieving commands from events scheduled within a fixed one-hour window between 22:00 and 23:00 UTC on May 13, 2050. Group-IB explains that the threat actor uses a hybrid encryption scheme that mixes RSA and AES-256-GCM algorithms to secure the communication over Microsoft Graph, keeping inbound and outbound channels cryptographically separated. HollowGraph's operational overviewSource: Group-IB HollowGraph has a second, unencrypted communication channel through DNS tunnelling, which is used to receive new Microsoft Entra ID details (Entra ID: tenantId, clientId, clientSecret, and mailbox) to authenticate to Microsoft Graph. It retrieves the values through IPv6 AAAA record queries to the attacker-controlled domain cloudlanecdn[.]com, and updates the configuration files stored as logAzure.txt. “Each returned IPv6 address (16 bytes) yields 14 usable payload bytes,” Group-IB explains. The malware assembles the payload from these 14-byte chunks, decodes it as UTF-8 text, and stores the result according to the corresponding configuration field. "HOLLOWGRAPH demonstrates a high level of technical sophistication. Its use of trusted cloud infrastructure for command-and-control, hybrid encryption, DNS tunneling for credential refresh, and highly selective victim targeting collectively suggest that the threat actor possesses significant technical capabilities and operational maturity," - Group-IB While the researchers cannot attribute HollowGraph to a known threat actor, their "analysis identified several technical similarities with the Iranian-nexus threat actor Lyceum." However, the available evidence is insufficient to attribute the activity to the threat actor with high confidence. By contrast, the researchers assess with high confidence that HollowGraph is linked to the Cavern framework. Group-IB suggests that organizations monitor Microsoft Graph and Microsoft 365 audit logs for suspicious application-driven calendar activity, particularly events in the far future, and unusual subjects and attachments. It is also recommended to look for indicators such as the ‘cloudlanecdn[.]com’ domain and the ‘logAzure.txt’ file, enforce Conditional Access, restrict and audit OAuth client-credential applications, and monitor outbound DNS for tunneling patterns. Test every layer before attackers do Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection. Get the whitepaper Related Articles: Microsoft warns of surge in ACR Stealer attacks on customersWordPress malware campaign hides payloads in Steam profilesNew ClickLock macOS malware traps users into revealing login passwordRussian hackers trojanize WebEx, Zoom apps to push Starland malwareAsyncAPI npm packages infected with credential-stealing malware
Indicators of Compromise
- domain — cloudlanecdn[.]com