hollowgraph

Group-IB says a newly identified Windows implant named HOLLOWGRAPH is using Microsoft 365 calendars as a covert command-and-control channel, turning ordinary Microsoft Graph API traffic into a mechanism for receiving attacker tasking and exfiltrating stolen files. The technique matters because...

Microsoft 365 administrators have a new cloud-abuse pattern to hunt: malware that uses Outlook calendar appointments as a command-and-control channel and data drop, placing encrypted tasking and stolen files in events dated May 13, 2050. The malware, dubbed HOLLOWGRAPH by Group-IB, communicates...