HOLLOWGRAPH Malware Exploits Microsoft 365 Calendars for Espionage
Group-IB has identified a new malware strain, HOLLOWGRAPH, that cleverly uses Microsoft 365 calendars as a covert channel for espionage. This malware is part of a larger toolkit associated with the Cavern backdoor framework, which is believed to be linked to Iranian cyber activities. Researchers discovered 12 infected systems, with three actively communicating, indicating a targeted operation against Israeli entities. The malware has been in use since at least June 3, 2026, with the last recorded contact occurring on July 9, 2026.
HOLLOWGRAPH operates by utilizing the Microsoft Graph API through a compromised mailbox, executing only two commands: get and send. To deliver instructions, attackers create calendar events dated far into the future, specifically May 13, 2050, to avoid detection. These events contain attached data that the malware retrieves. For exfiltrating stolen files, HOLLOWGRAPH generates its own calendar events with encrypted attachments.
Additionally, the malware employs DNS tunneling to manage credential renewal, sending IPv6 lookups to an attacker-controlled domain to refresh Microsoft Entra ID credentials. This process is designed to keep the updated credentials hidden, as they are saved to a file on disk disguised as a log. All communications are encrypted, ensuring that the separation of incoming instructions and outgoing files complicates potential decryption efforts.
Security teams are advised to monitor for unusual calendar events dated May 13, 2050, and subject lines that follow specific patterns, such as Event ID: or Boss{..}ID{..} with File{n}.txt attachments. It is also recommended to audit OAuth2 applications that utilize client credentials and to set alerts for the creation of new client secrets. Implementing Conditional Access, credential rotation, and monitoring for unusual tokens are essential practices for securing Microsoft 365 and Entra ID environments. Group-IB has provided further details on indicators of compromise in their blog.
