A newly discovered Windows malware, dubbed HOLLOWGRAPH, is hijacking Microsoft 365 calendar events to conduct covert espionage. By abusing the Microsoft Graph API, the malware creates a silent, encrypted command-and-control channel that blends into legitimate cloud traffic. Security analysts report the campaign shows a focused interest in Israeli entities.
How HOLLOWGRAPH Hijacks Microsoft 365
Unlike traditional malware that connects to external, suspicious servers, HOLLOWGRAPH operates entirely within trusted environments. The implant, identified as a .NET NativeAOT-compiled dynamic-link library, utilizes the Microsoft Graph API to turn a compromised user’s calendar into a two-way dead drop
. Because it communicates through Microsoft’s own infrastructure, the malicious activity is difficult to detect using standard perimeter defenses that rely on domain reputation or traffic filtering.
The malware’s communication is restricted to two commands: get
and send
. To avoid alerting the victim, the malware hides its activity by scheduling calendar events for May 13, 2050. Operators use these future-dated events to plant tasking instructions, while the malware exfiltrates stolen data by creating its own appointments with encrypted files attached.
Technical Sophistication and DNS Tunneling
Beyond the calendar-based command channel, the malware maintains a secondary, unencrypted path for credential management. It performs DNS tunneling using IPv6 AAAA record queries directed at the domain cloudlanecdn[.]com
. This process allows the implant to refresh its Microsoft Entra ID authentication tokens without triggering standard security alerts, ensuring the malware retains access to the victim’s account over time.
The Group-IB Threat Intelligence team noted that the malware uses the Microsoft Graph API through a compromised Microsoft 365 account to communicate with its operators, a technique that helps conceal command-and-control traffic within legitimate Microsoft 365 communications. It also uses DNS tunneling to refresh the Microsoft Entra ID credentials it authenticates with.
Security researchers note that the malware secures all Graph payloads using a hybrid encryption scheme involving RSA and AES-256-GCM. These communications are protected by separate RSA key pairs for each communication direction
, ensuring that tasking instructions and exfiltrated data remain cryptographically isolated.
Targeting and Attribution Uncertainties
While the exact identity of the threat actor remains unconfirmed, the scale of the campaign appears highly selective. Researchers have identified roughly 12 infected systems, with only about three showing active communication during the observation period. The concentration of compromised mailboxes in Israel, combined with malware samples uploaded from the region, suggests a focused espionage operation.
There is no definitive consensus on the operator’s identity. While researchers found similarities to tools previously associated with Iran-linked threat actors, they stress that they cannot definitively link the activity to a specific group. The current evidence is insufficient for formal attribution.
Defensive Challenges for Security Teams
The reliance on legitimate cloud services presents a significant hurdle for incident responders. Because HOLLOWGRAPH does not exploit a software vulnerability, simply applying security patches will not remove the attacker’s access. Instead, the malware leverages stolen or compromised cloud credentials to operate within the victim’s own environment.
Security teams are advised to move beyond perimeter monitoring and focus on mailbox and service-principal audit logs. Detecting this threat requires visibility into the specific API calls and calendar operations within the Microsoft 365 tenant, as traditional tools often categorize this traffic as standard business operations.
What to Watch Next
Analysts are monitoring for shifts in the malware’s command-and-control infrastructure and potential expansions beyond the currently identified 12 victims. Given the use of future-dated calendar events, investigators are particularly focused on auditing long-term calendar entries that may house hidden instructions for dormant or future tasks.
Keep reading
