**Hijacked Microsoft 365 Calendar Becomes a Command Channel: The HollowGraph Espionage Campaign**
A newly discovered espionage implant has been using a hijacked Microsoft 365 calendar as its command channel, planting operator instructions and smuggling out stolen files as attachments on calendar events dated to the year 2050.
Group-IB, which named the malware **HollowGraph**, says the approach moves tasking and stolen data through legitimate Microsoft Graph API traffic, so the activity looks like ordinary Microsoft 365 chatter and network controls keyed to attacker-owned destinations have nothing to flag.
The implant is a .NET DLL that supports just two commands, `get` and `send`, and it never reaches out to an attacker-owned server for payloads. Instead, it treats the compromised mailbox’s calendar as a two-way dead drop.
To pull tasking, it queries the calendar for an event the operator has planted, buried at `2050-05-13`, so the mailbox owner is unlikely to ever scroll to it, and reads its instructions from an attached file. To exfiltrate, it does the reverse: encrypts the stolen file, creates its own far-future event, and uploads the data as one or more attachments.
Everything moving through the calendar is wrapped in hybrid RSA and AES-256 encryption, with separate key pairs for incoming tasking and outgoing data.
A second, cruder channel keeps that Graph access alive. Over DNS, HollowGraph refreshes the app’s Entra ID (Azure AD) login details: its tenant ID, client ID, client secret and target mailbox. It decodes those values from IPv6 AAAA records sent back by an attacker domain, `cloudlanecdn[.]com`, then writes them to `logAzure.txt`, a file dressed up as a routine log. Those are stored client-credentials, not access tokens, and unlike the calendar traffic this channel runs in the clear.
Group-IB ties HollowGraph to **Cavern** with high confidence, on shared command syntax and matching internal tasking. Cavern is a modular backdoor framework that Check Point documented earlier this month and attributed to an Iranian Ministry of Intelligence and Security-linked actor it calls **Cavern Manticore**, a cluster it says overlaps with the known Iranian groups MuddyWater and Lyceum.
But the firm link is to the code, not the crew. Group-IB will not name the operator behind this campaign: “Based on the evidence currently available, we cannot confidently attribute this activity to any previously identified threat actor,” it wrote, noting only a low-confidence overlap with Lyceum, a subgroup of the Iranian actor OilRig. The compromised exfiltration mailbox belongs to an Israeli organization, but Group-IB treats that as victim geography, not attribution.
Group-IB found the implant on at least 12 machines, only about three of them actively talking to the attacker during the analysis window, with victim traffic running from 3 June to 9 July 2026. It reads that small, selective footprint as targeted espionage rather than opportunistic crime, even though the technique behind it could be reused far more widely than this one campaign.
There is no Microsoft software vulnerability here and no patch to deploy. HollowGraph rides a compromised account and the Graph API’s normal functionality, which is exactly why it is hard to spot. The work is on identity and application permissions plus monitoring, not a patch.
—
### What to Watch For
Group-IB’s detection advice leans on the malware’s own habits, and the sharpest signals live in the calendar itself. Hunt for events that carry:
– A far-future date, specifically `2050-05-13`;
– A subject that is a bare GUID, or that matches the operator’s `Event ID:` or `Boss{..}ID{..}` naming;
– Attachments named `File{n}.txt`.
On the identity side, the firm recommends restricting and auditing the client-credential OAuth apps that can reach Graph and alerting on newly created client secrets, plus the usual Entra ID hygiene of Conditional Access, credential rotation, and anomalous-token detection.
For detection, audit Microsoft Graph and mailbox activity for application-driven calendar changes: events created, attachments uploaded, or subjects renamed by an app rather than a person. Watch DNS too, for unusually frequent AAAA queries and long, high-entropy subdomains aimed at a single domain. Hunting for `cloudlanecdn[.]com` and the `logAzure.txt` config file is the fast first pass, and the full indicator set, including file hashes, is in Group-IB’s report.
Hiding command-and-control in trusted Microsoft services is not new; attackers have already run it through Outlook inboxes, draft folders and OneDrive. Events parked in 2050, out where no one looks, are simply the latest spot defenders had no reason to inspect. The operator still has no name, and victim traffic was flowing as recently as 9 July, which makes those far-future calendar entries worth a look now.
—
### FAQ
**Q1: What is HollowGraph?**
HollowGraph is a malware implant that abuses a hijacked Microsoft 365 calendar to exchange commands and exfiltrated data. It uses the Microsoft Graph API for all communication, making its traffic blend in with normal Office 365 activity.
**Q2: How does HollowGraph use calendar events?**
The implant checks a compromised calendar for a far-future event (scheduled around 2050-05-13) containing instructions and attachments. It reads tasking from these events and uploads stolen data as encrypted attachments to new far-future events.
**Q3: Is this caused by a vulnerability in Microsoft 365?**
No. The technique exploits legitimate Graph API functionality and a compromised account, not a software vulnerability. There is no patch; mitigation focuses on identity and permissions monitoring.
**Q4: How can I detect HollowGraph activity?**
Look for calendar events with far-future dates, GUID-like subjects, or suspicious attachment names like `File{n}.txt`. Monitor for new client secrets in Entra ID, restrict OAuth app permissions, and audit unusual DNS AAAA queries to `cloudlanecdn[.]com`.
**Q5: Which threat actor is responsible?**
Group-IB links HollowGraph to the Cavern backdoor framework (associated with Cavern Manticore, an Iranian state-aligned group) but cannot definitively attribute the campaign to a specific actor at this time.
**Q6: Who is the target?**
The compromised mailbox belonged to an Israeli organization, but this is considered victim geography rather than definitive attribution. The campaign appears highly targeted.
—
### Conclusion
The HollowGraph campaign demonstrates a sophisticated abuse of Microsoft 365’s legitimate cloud services to conduct stealthy espionage. By embedding command-and-control and data exfiltration within calendar events and Graph API traffic, the attackers effectively bypass traditional security controls that focus on perimeter defenses and known malicious destinations.
Defending against such tactics requires a shift toward identity-centric security: rigorous management of OAuth applications, continuous monitoring of anomalous calendar and API activity, and strict oversight of client credentials. While no patch exists, heightened vigilance and thorough hunting for far-future calendar events can reveal hidden compromises. As attackers continue to leverage trusted platforms, organizations must ensure that visibility and control extend to the cloud services themselves.
