Malware
HollowGraph
- First Reported
- Jul 20, 2026
- Latest Reported
- Jul 21, 2026
Reported Context (3)
- Dubbed HollowGraph, the malware is believed to be part of a larger toolkit and is likely linked to Cavern Manticore, an Iran-nexus threat actor that Check Point detailed earlier this month. HollowGraph Malware Uses Microsoft 365 Calendar for Command and Control
- Group-IB has uncovered HollowGraph, a .NET espionage implant that uses a hijacked Microsoft 365 calendar and Microsoft Graph API traffic to receive instructions and exfiltrate stolen files through far-future calendar HollowGraph Uses Microsoft 365 Calendar Events for C2 and Data Exfiltration
- HollowGraph abuses the calendar feature in compromised Microsoft 365 mailboxes as a covert command-and-control channel to receive instructions and exfiltrate stolen data. HollowGraph Malware Uses Microsoft 365 Calendars for Covert C2
Malware (1)
Threat Actors (4)
MITRE ATT&CK (8)
Vendors (1)
Products (4)
Tools (1)
Countries (2)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.