cyber.hendryadrian.com
Threat Research · securityweek.com

HollowGraph Malware Uses Microsoft 365 Calendar for Command and Control

· Original article ↗

Summary

Group-IB reports that HollowGraph uses Microsoft 365 calendar events for command and control and file exfiltration, with DNS tunneling for configuration updates. It identified 12 victims; attribution to Lyceum remains low-confidence.

Key points

  • HollowGraph uses the Microsoft Graph API and a compromised Microsoft 365 account in Israel to exchange commands and data through calendar events.
  • Operators can plant tasking in events; the malware can search for those events and download instructions, or create events with encrypted stolen files attached.
  • Calendar events are dated far in the future, and the malware uses hybrid RSA and AES encryption for payloads.
  • A secondary DNS-tunneling channel refreshes the malware’s configuration and Microsoft Entra ID credentials.
  • Group-IB identified 12 victims, including three actively communicating with attacker infrastructure; the earliest observed communication was June 3.
  • Group-IB says evidence suggests focused interest in Israeli entities. It assesses a possible link to Lyceum with low confidence and says the available evidence is insufficient for confident attribution.

Article Details

Attack Vectors
  • HollowGraph uses a compromised Microsoft 365 account and Microsoft Graph API calendar events for two-way command-and-control communication.
  • The malware attaches encrypted stolen files to calendar events for exfiltration and retrieves operator-planted events as instructions.
  • HollowGraph uses DNS tunneling to refresh its configuration and Microsoft Entra ID credentials.

MITRE ATT&CK

T1041 · Exfiltration Over C2 ChannelThe malware exfiltrates stolen files by attaching encrypted data to calendar events used as its command-and-control channel.T1071.004 · DNSHollowGraph performs DNS tunneling to refresh its configuration and Microsoft Entra ID credentials.T1078.004 · Cloud AccountsHollowGraph authenticates using a compromised Microsoft 365 account.T1102.002 · Bidirectional CommunicationHollowGraph uses Microsoft Graph API calendar events for bidirectional command-and-control communication.T1552.001 · Credentials In FilesHollowGraph's configuration, including a client secret, is written to disk as logAzure.txt.

Threat Actors

Cavern ManticoreHollowGraph is described as likely linked to Cavern Manticore, but the article reports that attribution to a previously identified actor is not confident.LyceumGroup-IB attributes the activity to Lyceum with low confidence, citing technical similarities that it says are not sufficiently unique for high-confidence attribution.

Malware

HollowGraphDubbed HollowGraph, the malware is believed to be part of a larger toolkit and is likely linked to Cavern Manticore, an Iran-nexus threat actor that Check Point detailed earlier this month.

Vendors

MicrosoftA recently discovered piece of malware abuses the Microsoft 365 calendar for command-and-control (C&C) communication, Group-IB reports.

Products

Microsoft 365 Apps for EnterpriseA recently discovered piece of malware abuses the Microsoft 365 calendar for command-and-control (C&C) communication, Group-IB reports.Microsoft Entra IDAdditionally, HollowGraph retains a secondary communication channel, performing DNS tunneling to refresh its configuration and Microsoft Entra ID (Azure AD) credentials it uses for authentication.Microsoft GraphThe malware’s communication mechanism relies on the Microsoft Graph API and a compromised 365 account in Israel to hide its C&C communication within legitimate traffic.

Countries

IranDubbed HollowGraph, the malware is believed to be part of a larger toolkit and is likely linked to Cavern Manticore, an Iran-nexus threat actor that Check Point detailed earlier this month.IsraelThe malware’s communication mechanism relies on the Microsoft Graph API and a compromised 365 account in Israel to hide its C&C communication within legitimate traffic.

Related Articles