Windows Malware HOLLOWGRAPH Uses Microsoft 365 Calendars as a Covert Command Channel

How HOLLOWGRAPH Weaponizes Microsoft 365 Calendars

Security researchers at Group-IB have identified a Windows malware component that uses Microsoft 365 calendars as a covert communication channel. Named HOLLOWGRAPH, the malware works through the Microsoft Graph API and a compromised Microsoft 365 account, allowing attackers to send instructions and retrieve stolen files while appearing to use legitimate cloud services.

The technique described by Group-IB treats the victim's calendar as a "two-way dead drop." Attackers create calendar events containing encrypted commands, while HOLLOWGRAPH uploads stolen files as attachments to separate events. All events are scheduled for May 13, 2050, placing them far outside the normal calendar view of the mailbox owner. This lets the malware communicate through Microsoft's own infrastructure instead of connecting directly to an attacker-controlled server for its main command channel. The malware supports just two commands: "get" to retrieve instructions and "send" to exfiltrate files.

Group-IB found at least 12 infected systems, three of which were actively communicating with the attacker between June 3 and July 9. Evidence points to Israeli targets: a compromised mailbox tied to an Israeli organization and malware samples uploaded from Israel. The firm described the campaign as highly targeted rather than opportunistic, and linked HOLLOWGRAPH with high confidence to the Cavern backdoor framework based on command syntax and architecture. Attribution remains uncertain, although researchers noted low-confidence technical overlap with Lyceum, an Iranian-linked subgroup of OilRig.

HOLLOWGRAPH also maintains a backup channel using DNS tunneling. It sends specially constructed IPv6 address queries to an attacker-controlled domain to obtain fresh Microsoft Entra ID credentials — including tenant ID, client ID, client secret and mailbox address — needed for Graph access. Commands and stolen data are protected with RSA and AES encryption, and separate key pairs for incoming and outgoing traffic mean one compromised key does not immediately expose both directions.

What HOLLOWGRAPH's Design and Israeli Targeting Reveal

HOLLOWGRAPH's Calendar Dead Drop and the Cavern Link

The core of HOLLOWGRAPH's design is that an organization's own Microsoft 365 tenant becomes the attacker's mailbox. Instructions arrive as calendar entries, and stolen files leave as attachments. Because the traffic passes through Microsoft Graph against a legitimate account, it does not trigger the kind of network alerts that a direct command-and-control connection would. Scheduling events for 2050 is a simple but effective way to keep them out of the owner's everyday view.

The limited command set — only "get" and "send" — indicates HOLLOWGRAPH is not a standalone backdoor. Group-IB's high-confidence link to the Cavern framework suggests it is one module in a larger toolkit, with other components likely handling the actual compromise of the mailbox and movement inside the network. This is consistent with a well-resourced operation that can afford to build specialized tools for each stage.

Israeli Targeting and the Unresolved Lyceum Overlap

The scale of the campaign — 12 infections, only three actively communicating — is small, and the Israeli victim footprint is specific. Group-IB's assessment that the operation is highly targeted fits the pattern: this looks like espionage against a particular set of organizations rather than a broad ransomware-style campaign. The low-confidence link to Lyceum is worth noting but should not be treated as a conclusion; Group-IB explicitly said it could not confidently attribute the campaign to a known actor.

Pushing Detection Into Microsoft Graph and OAuth Audits

HOLLOWGRAPH is part of a broader trend of attackers hiding behind trusted services — signed applications, remote management software, cloud infrastructure. The technique shifts the detection burden to identity and cloud audit logs rather than the network perimeter. Group-IB's indicators include unusual calendar operations in Microsoft Graph and mailbox audit logs, events dated far into the future, encrypted text attachments, application-generated subject changes, and the logAzure.txt configuration file. The DNS tunneling fallback adds another signal: unusually frequent IPv6 queries or long, high-entropy subdomains. Organizations that do not review OAuth application permissions and Entra ID credentials may struggle to spot this kind of abuse until data is already leaving the tenant.

Detection and Response Checklist for Microsoft 365 Security Teams

For security teams running Microsoft 365, the practical takeaway is that legitimate cloud infrastructure can carry attacker traffic. Group-IB's report points to specific controls worth reviewing:

• Monitor Microsoft Graph and mailbox audit logs for calendar events dated far into the future — HOLLOWGRAPH used May 13, 2050.
• Flag calendar events with encrypted text attachments or application-generated subject changes, and check for the logAzure.txt configuration file.
• Audit OAuth applications and Microsoft Entra ID permissions; rotate client secrets and credentials if any exposed account shows anomalous Graph activity.
• Watch for unusually frequent IPv6 DNS queries or long, high-entropy subdomains, which may signal the DNS tunneling channel HOLLOWGRAPH uses to refresh credentials.
• Treat small targets seriously: the campaign had only 12 infections and focused on Israeli organizations, so low volume is not evidence of low risk.