HollowGraph Malware Uses Microsoft 365 Calendars for Covert C2
Summary
Group-IB says HollowGraph uses compromised Microsoft 365 calendars for covert C2 and data theft, with DNS tunneling to refresh Entra ID credentials. Researchers link it to Cavern but say evidence is insufficient to attribute it to Lyceum.
Key points
- HollowGraph uses compromised Microsoft 365 mailboxes and Microsoft Graph calendar events to receive commands and exfiltrate stolen files.
- A configuration file named logAzure.txt contains hardcoded Microsoft Graph authentication details, including an Entra ID client secret and target mailbox.
- The malware uses future-dated calendar events as a covert dead-drop; its GET and SEND commands retrieve instructions and create entries with encrypted stolen data.
- Group-IB says HollowGraph uses RSA and AES-256-GCM for communications and file protection.
- DNS tunneling via AAAA queries to cloudlanecdn[.]com supplies updated Entra ID configuration data.
- Researchers report at least 12 infected systems, with three actively communicating between June 3 and July 9; they assess a link to the Cavern framework with high confidence but say evidence is insufficient to attribute the activity to Lyceum.
- Group-IB recommends monitoring Microsoft 365 audit logs for unusual future calendar events and attachments, auditing OAuth applications, and watching outbound DNS for tunneling.
Article Details
- Attack Vectors
- HollowGraph uses calendar events in compromised Microsoft 365 mailboxes to receive commands and exfiltrate stolen files as attachments.
- The malware uses DNS tunneling through AAAA record queries to cloudlanecdn[.]com to retrieve updated Microsoft Entra ID configuration details.
- HollowGraph authenticates to Microsoft Graph using hardcoded credentials stored in a file named logAzure.txt.
- Defensive Notes
- Monitor Microsoft Graph and Microsoft 365 audit logs for suspicious application-driven calendar activity, especially far-future events and unusual subjects or attachments.
- Look for cloudlanecdn[.]com and the logAzure.txt file.
- Enforce Conditional Access, restrict and audit OAuth client-credential applications, and monitor outbound DNS for tunneling patterns.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | cloudlanecdn[.]com | Attacker-controlled domain queried by HollowGraph over DNS to retrieve updated Microsoft Entra ID configuration. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelHollowGraph sends stolen data to the attacker in encrypted files attached to Microsoft 365 calendar events.T1071.004 · DNSHollowGraph uses DNS AAAA record queries to cloudlanecdn[.]com to retrieve configuration data.T1078.004 · Cloud AccountsHollowGraph authenticates to Microsoft Graph using hardcoded credentials associated with a compromised Microsoft 365 account.T1102.002 · Bidirectional CommunicationHollowGraph uses Microsoft Graph calendar events as a bidirectional covert channel for commands and stolen files.T1573.001 · Symmetric CryptographyThe article says HollowGraph uses AES-256-GCM as part of its hybrid encryption scheme for communications.T1573.002 · Asymmetric CryptographyThe article says HollowGraph uses RSA keys as part of its hybrid encryption scheme for communications.
Threat Actors
Malware
Vendors
Products
Microsoft 365 Apps for EnterpriseHollowGraph abuses the calendar feature in compromised Microsoft 365 mailboxes as a covert command-and-control channel to receive instructions and exfiltrate stolen data.Microsoft Entra IDThe configuration file is stored as logAzure.txt to appear as a regular log file, and “includes the Microsoft Entra ID tenant ID, application (client) ID, client secret, target mailbox address, command-and-control (C2)Microsoft GraphThe malware authenticates to Microsoft Graph with hardcoded credentials from a fake log file named logAzure.txt.