HollowGraph Malware Uses Microsoft 365 Calendar Events as Dead-Drop C2 Channel

What Happened

On July 20, 2026, cybersecurity firm Group-IB disclosed a new espionage implant dubbed HollowGraph that hijacks compromised Microsoft 365 mailboxes to run a command-and-control (C2) channel hidden inside calendar events. The malware attaches encrypted files to calendar entries dated May 13, 2050 — far enough in the future that a mailbox owner would never scroll to them — and retrieves operator instructions from the same dead drop. All traffic moves through the Microsoft Graph API, making the activity indistinguishable from legitimate M365 usage.

At least 12 systems have been infected, with three actively communicating with the threat actor between June 3 and July 9, 2026. The indicators point to a targeted espionage campaign focused on Israeli organizations.

Technical Analysis

HollowGraph is a lightweight .NET DLL that supports only two commands: GET and SEND. To receive tasking, it queries the compromised mailbox's calendar for an event titled in the format "Event ID: <7-char-taskID>", downloads the attached file, and decrypts it using RSA and AES-256-GCM. To exfiltrate data, the implant creates a new calendar entry titled "Boss{..}ID{..}" and uploads stolen files encrypted with the attacker's public RSA key.

The Group-IB research team described the mailbox calendar as a "covert dead-drop," with HollowGraph retrieving commands from events scheduled within a fixed one-hour window between 22:00 and 23:00 UTC on the far-future date. The hybrid encryption scheme uses separate RSA key pairs for inbound and outbound channels, keeping them cryptographically isolated.

A second, unencrypted channel runs over DNS tunneling. HollowGraph refreshes its Microsoft Entra ID (Azure AD) credentials by querying IPv6 AAAA records from the attacker-controlled domain cloudlanecdn[.]com. Each returned IPv6 address yields 14 usable payload bytes, which the malware assembles and decodes as UTF-8 text to update its logAzure.txt configuration file — a file masquerading as a routine log entry.

Group-IB assessed with high confidence that HollowGraph is linked to the Cavern backdoor framework, a modular C2 toolkit previously connected to Iranian-nexus activity. While technical similarities to the Lyceum threat actor were noted, the evidence is insufficient for a definitive attribution.

Who's Affected

The campaign targets organizations using Microsoft 365, with indicators pointing specifically to entities in Israel. Any enterprise relying on M365 calendar and Graph API integrations is exposed to this attack vector. The technique is not limited to a single vertical — the attacker specifically chose Microsoft cloud infrastructure because its API traffic blends into normal corporate usage patterns.

The real danger is that traditional network security controls keyed to attacker-owned destinations have nothing to flag. All data flows through Microsoft's legitimate cloud endpoints, making detection significantly harder than conventional C2 channels.

How to Protect Yourself

• Monitor Microsoft 365 audit logs for suspicious application-driven calendar activity, especially events in the far future or with unusual subjects and attachments.


• Hunt for the logAzure.txt file across endpoints and investigate any OAuth client-credential applications that appear unauthorized.


• Enforce Conditional Access policies and restrict OAuth app registrations to approved publishers only.


• Monitor outbound DNS for tunneling patterns — particularly unusual IPv6 AAAA record queries to domains like cloudlanecdn[.]com.


• Audit Microsoft Graph API permissions and regularly review which applications have mailbox access.

The Sable Angle

HollowGraph is a textbook example of how modern attackers weaponize trusted cloud infrastructure. At Sable, our offensive research team regularly maps these blind spots for enterprise clients — testing whether their detections catch API-based C2, DNS tunneling, and credential rotation hiding in plain sight.

Our platform can simulate adversary-in-the-middle techniques that abuse legitimate SaaS APIs, helping security teams validate their detection coverage before a real Iranian-nexus APT group targets their mailbox. Learn more about our approach at /research/openclaw.