HollowGraph Uses Microsoft 365 Calendar Events for C2 and Data Exfiltration
Summary
Group-IB says HollowGraph uses compromised Microsoft 365 calendars and Graph API traffic for tasking and encrypted file exfiltration, refreshes Entra ID credentials over DNS, and is linked to Cavern; the campaign’s operator remains unattributed.
Key points
- Group-IB describes HollowGraph as a .NET DLL with get and send commands that uses a compromised Microsoft 365 mailbox calendar as a two-way dead drop over Microsoft Graph API.
- The implant reads instructions from a calendar event dated 2050-05-13 and uploads encrypted stolen files as attachments to its own far-future events, using hybrid RSA and AES-256 encryption.
- HollowGraph uses DNS AAAA records from cloudlanecdn[.]com to refresh Entra ID tenant and client credentials, a client secret, and the target mailbox; this channel is unencrypted.
- Group-IB found the implant on at least 12 machines, with about three actively communicating during its analysis window; victim traffic ran from 3 June to 9 July 2026.
- Group-IB links HollowGraph’s code to the Cavern framework with high confidence, but says it cannot confidently attribute the operation to a known actor; a possible Lyceum overlap is low confidence.
- Recommended checks include far-future calendar events, unusual event subjects and attachment names, app-driven Graph and mailbox changes, suspicious AAAA-query patterns, and client-credential OAuth apps.
Article Details
- Attack Vectors
- HollowGraph uses a compromised Microsoft 365 calendar and Microsoft Graph API traffic to retrieve instructions from an event dated 2050-05-13.
- The implant encrypts stolen files and uploads them as attachments to far-future calendar events.
- HollowGraph uses DNS AAAA records from cloudlanecdn[.]com to refresh Entra ID client-credential details and the target mailbox.
- Defensive Notes
- Hunt for calendar events dated 2050-05-13, events with bare GUID or operator-style subjects such as Event ID: or Boss{..}ID{..}, and attachments named File{n}.txt.
- Audit Microsoft Graph and mailbox activity for application-driven calendar changes, including event creation, attachment uploads, and subject changes.
- Restrict and audit client-credential OAuth applications with Graph access; alert on newly created client secrets and apply Conditional Access, credential rotation, and anomalous-token detection.
- Monitor for unusually frequent DNS AAAA queries and long, high-entropy subdomains directed at cloudlanecdn[.]com; hunt for the logAzure.txt configuration file.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | cloudlanecdn[.]com | Attacker domain whose DNS AAAA responses provide HollowGraph with Entra ID client-credential details. |
MITRE ATT&CK
T1071.004 · DNSHollowGraph receives refreshed Entra ID client-credential details in DNS AAAA records returned by cloudlanecdn[.]com.T1078.004 · Cloud AccountsThe implant operates through a compromised Microsoft 365 mailbox calendar.T1102.002 · Bidirectional CommunicationHollowGraph uses a compromised Microsoft 365 calendar through Microsoft Graph as a two-way dead drop for tasking and stolen-file attachments.T1567 · Exfiltration Over Web ServiceThe implant exfiltrates encrypted stolen files as attachments on calendar events through Microsoft Graph.
Threat Actors
Cavern ManticoreCheck Point attributed the Cavern backdoor framework to this Iranian Ministry of Intelligence and Security-linked actor. Group-IB links HollowGraph to Cavern but does not confidently attribute the campaign to a known actor.LyceumCheck Point reported overlap between Cavern Manticore and Lyceum. Group-IB also noted only a low-confidence overlap between the HollowGraph activity and Lyceum.MuddyWaterCheck Point reported that Cavern Manticore overlaps with MuddyWater; the article does not attribute the HollowGraph operation to MuddyWater.OilRigThe article identifies OilRig as the Iranian actor of which Lyceum is a subgroup; Group-IB's reported overlap with the HollowGraph activity is low confidence and concerns Lyceum.
Malware
CavernThe campaign also uses DNS to refresh Entra ID client-credential details, and Group-IB links the implant to Cavern with high confidence but does not confidently attribute the operation to a known threat actor.HollowGraphGroup-IB has uncovered HollowGraph, a .NET espionage implant that uses a hijacked Microsoft 365 calendar and Microsoft Graph API traffic to receive instructions and exfiltrate stolen files through far-future calendar
Vendors
Products
Entra IDThe campaign also uses DNS to refresh Entra ID client-credential details, and Group-IB links the implant to Cavern with high confidence but does not confidently attribute the operation to a known threat actor.Microsoft 365 Apps for EnterpriseGroup-IB has uncovered HollowGraph, a .NET espionage implant that uses a hijacked Microsoft 365 calendar and Microsoft Graph API traffic to receive instructions and exfiltrate stolen files through far-future calendarMicrosoft Graphhas uncovered HollowGraph, a .NET espionage implant that uses a hijacked Microsoft 365 calendar and Microsoft Graph API traffic to receive instructions and exfiltrate stolen files through far-future calendar events.