HOLLOWGRAPH turns Microsoft 365 calendars into hidden command and control channels

Group IB has identified HOLLOWGRAPH, an advanced Windows-based malware that abuses the Microsoft Graph API to create a hidden command and control channel through Microsoft 365 calendars. Attackers can both send commands and exfiltrate data through calendar events, while also using DNS tunneling to update credentials without arousing suspicion.

According to Group-IB, HOLLOWGRAPH is linked to the modular backdoor framework Cavern and uses a compromised Microsoft 365 account to communicate with the attacker. By leveraging the Microsoft Graph API, the malicious code can hide its traffic among legitimate Microsoft 365 communications, making it significantly harder to detect.

Microsoft 365 Calendar is used as a hidden “dead drop”

HOLLOWGRAPH turns the victim's Microsoft 365 calendar into a two-way communication channel between the attacker and the infected computer.

The attacker places encrypted instructions as attachments to calendar events, while the infected device uploads stolen files by creating its own calendar events with encrypted attachments. To minimize the risk of the user discovering the activity, all events are scheduled to the May 13, 2050.

Two commands are enough for advanced data theft

Malicious code supports only two commands:

• goat retrieves instructions from the calendar.
• send encrypts and exfiltrates files by creating new calendar events.

Communication is protected with hybrid encryption where RSA-OAEP used for key exchange and AES-256-GCM for the data itself. Separate key pairs are used for incoming and outgoing communication, which further complicates analysis and decryption.

DNS tunneling is used to update credentials

In addition to the Microsoft Graph API, HOLLOWGRAPH uses a separate communication channel based on DNS tunneling.

Through specially crafted IPv6 AAAA queries against the attacker's domain, it retrieves updated Microsoft Entra ID details, including:

• Tenant ID
• Client ID
• Client Secret
• Target's mailbox

The new credentials are then saved locally in a configuration file that pretends to be a regular log file.

At least twelve identified victims

Group-IB has identified at least twelve compromised systems, where about three actively communicated with the attacker's infrastructure during the observation period.

The first observed communication occurred on June 3, 2026, while the latest was recorded on July 9, 2026.

The telemetry shows that the operation was highly selective. Several indicators point to the attacks being primarily directed at Israeli organizations, including through the compromised Microsoft 365 mailbox and other observed infrastructure.

Connections to Cavern and possible ties to Lyceum

Group IB assesses with high security that HOLLOWGRAPH is part of Cavern Framework, a modular backdoor framework.

The researchers also see technical similarities with the Iranian-linked threat actor. High school, previously associated with the group Oil Rig. However, Group-IB believes that the evidence is not yet sufficient for a certain attribution and describes the connection as an assessment with low security.

A new generation of cloud-based C2 channels

HOLLOWGRAPH illustrates how modern threat actors are increasingly leveraging trusted cloud services instead of their own infrastructure.

By using Microsoft Graph API, Microsoft 365, and DNS tunneling, malicious traffic can blend in with normal business traffic, making traditional network-based security controls significantly less effective.

The development also shows how identities, API permissions and cloud services are becoming increasingly important attack surfaces in modern cyber operations, where legitimate enterprise platforms are used to hide advanced espionage and data theft campaigns.