HollowGraph Malware Uses Microsoft 365 Calendar as Espionage Dead Drop

A newly uncovered espionage implant named HollowGraph is abusing Microsoft 365 calendar infrastructure as a covert command-and-control channel, smuggling both operator instructions and exfiltrated files inside events dated May 13, 2050. Discovered by Group-IB, the .NET DLL implant never contacts attacker-owned servers directly. Instead, it treats the victim's compromised mailbox calendar as a two-way dead drop, reading tasking from one far-future event attachment and uploading encrypted stolen data to another, all wrapped in hybrid RSA and AES-256 encryption. Because every exchange travels through legitimate Microsoft Graph API traffic, conventional network controls that block known malicious destinations have nothing to flag, making this a textbook cloud-native evasion technique that defenders can validate against their own tenants with a quick privacy checkup.

A secondary, cruder channel keeps the Graph access alive. HollowGraph refreshes its Entra ID credentials — tenant ID, client ID, client secret, and target mailbox — over DNS, decoding those values from IPv6 AAAA records returned by the attacker domain cloudlanecdn[.]com and writing them to a file masquerading as a routine log called logAzure.txt. Because these are stored client-credentials rather than access tokens, anyone investigating suspicious DNS queries can confirm exposure with a DNS leak test, while security teams hunting infrastructure can pivot on the C2 domain using a WHOIS lookup to map related registrations.

Group-IB ties HollowGraph to the Cavern backdoor framework with high confidence based on shared command syntax and matching internal tasking logic. Cavern was documented earlier this month by Check Point, which attributed it to an Iranian Ministry of Intelligence and Security-linked cluster called Cavern Manticore, overlapping with the known Iranian groups MuddyWater and Lyceum. Group-IB stops short of firm attribution, noting only a low-confidence overlap with Lyceum, an OilRig subgroup, and treating the Israeli victim's geography as targeting rather than attribution. The implant was found on at least 12 machines, with only three actively communicating during the June 3 to July 9, 2026 analysis window — a selective footprint consistent with targeted espionage rather than opportunistic crime, even though the calendar-dead-drop technique itself is reusable across any organization running Microsoft 365.