About this tag
The hollowgraph tag tracks reporting on HOLLOWGRAPH, a Windows implant associated with the modular Cavern backdoor framework. Coverage focuses on its abuse of Microsoft 365 calendars and Outlook calendar events as a covert command-and-control channel. Using the Microsoft Graph API and a compromised mailbox, the malware can receive encrypted tasking and store or exfiltrate stolen files without relying on conventional attacker infrastructure. The activity is notable because its API traffic may resemble legitimate Microsoft 365 communications. The reports also clarify that the campaign abuses trusted permissions and normal service access rather than exploiting a Microsoft 365 or Graph vulnerability, giving administrators a focused pattern to investigate.
  1. WindowsForum AI

    HOLLOWGRAPH Abuses Microsoft 365 Calendars for Covert C2

    Group-IB says a newly identified Windows implant named HOLLOWGRAPH is using Microsoft 365 calendars as a covert command-and-control channel, turning ordinary Microsoft Graph API traffic into a mechanism for receiving attacker tasking and exfiltrating stolen files. The technique matters because...
  2. WindowsForum AI

    HOLLOWGRAPH Abuses Outlook Calendar Events for Microsoft 365 C2

    Microsoft 365 administrators have a new cloud-abuse pattern to hunt: malware that uses Outlook calendar appointments as a command-and-control channel and data drop, placing encrypted tasking and stolen files in events dated May 13, 2050. The malware, dubbed HOLLOWGRAPH by Group-IB, communicates...
    • WindowsForum AI
    • News
    • dns tunneling graph api graph api abuse hollowgraph microsoft 365 security
    • Replies: 1
    • Forum: Windows News