Microsoft 365 administrators have a new cloud-abuse pattern to hunt: malware that uses Outlook calendar appointments as a command-and-control channel and data drop, placing encrypted tasking and stolen files in events dated May 13, 2050.
The malware, dubbed HOLLOWGRAPH by Group-IB, communicates through a compromised Microsoft 365 mailbox using the Microsoft Graph API rather than directly contacting attacker-run infrastructure. As reported by The Register and detailed by Group-IB on July 20, the campaign is not exploiting a Microsoft 365 or Graph vulnerability. It is abusing the trust, permissions, and ordinary API traffic that many organizations already allow.
That distinction matters. There is no emergency Microsoft patch to deploy. The immediate work is identity investigation: reviewing compromised accounts, OAuth and Entra ID application activity, Graph permissions, calendar audit events, and suspicious DNS traffic.
HOLLOWGRAPH appears designed as a lean Windows implant rather than a broad malware toolkit. Its job is to read instructions from a calendar appointment, execute its limited tasking, and place collected files into newly created calendar events for an operator to retrieve later.
The use of appointments in 2050 is a practical concealment technique. A future date keeps the entries out of the day-to-day Outlook views where users, executive assistants, and administrators might notice them. Encrypted attachments and non-obvious event subjects further reduce the chance that a casual mailbox review exposes the traffic.
According to Group-IB, the implant uses two core commands: one to retrieve tasking and one to send data. The retrieved instructions and the exfiltrated material are protected with hybrid RSA and AES-256-GCM encryption, so even an administrator who finds the events may not be able to interpret their contents without additional forensic work.
The important operational point is that the Graph requests can resemble legitimate Microsoft 365 application traffic. A conventional web proxy rule that spots a workstation repeatedly connecting to an unknown domain offers little help when the destination is Microsoft’s own cloud service and the account already has valid credentials.
That combination changes how defenders should interpret a seemingly ordinary Microsoft 365 session. Graph activity is the visible working channel, while DNS may be the bootstrap or credential-refresh path that keeps the operation alive. The malware reportedly does not encrypt that DNS-tunneling channel, potentially giving network defenders a useful detection opportunity if they retain and inspect recursive DNS logs.
The campaign’s use of Entra ID credentials also puts the incident squarely in the identity-security category. A cleaned Windows endpoint is not necessarily a cleaned environment if the associated identity, refresh tokens, OAuth grants, application registration, or mailbox permissions remain available to the attacker.
Microsoft’s own documentation makes clear why permissions deserve attention here. Graph permissions such as
The available evidence points toward a narrowly targeted espionage operation focused on Israeli entities. Group-IB cited the Israeli organization associated with the compromised mailbox, the origin of malware uploads, and related Cavern framework material uploaded from Israel. That is not evidence that every Microsoft 365 tenant should expect an imminent HOLLOWGRAPH intrusion, but it is evidence that sophisticated operators are willing to repurpose business SaaS services for targeted operations.
Group-IB linked HOLLOWGRAPH to the Cavern framework with high confidence based on matching command structures and implementation details. The researchers also found similarities to Lyceum, an Iranian-linked espionage actor, but characterized that connection as low confidence. Administrators should not let the Iran angle become the story: attribution is preliminary, while the detection and containment requirements are immediate and broadly applicable.
That makes a targeted historical search feasible for many organizations, particularly because HOLLOWGRAPH’s calendar artifacts reportedly share a conspicuously distant date. But a search solely for May 13, 2050 would be too narrow a response. The date is an indicator from the observed samples, not a permanent attacker requirement. Future-dated entries, encrypted or unexplained attachments, strange calendar subjects, unusual application identities, and a mismatch between the apparent creator and user behavior should all be treated as investigation leads.
A first-pass hunt should include the following:
The more durable response is to make cloud activity attributable. Every application with mailbox or calendar access should have an owner, a documented business purpose, minimal permissions, a consent trail, and periodic review. High-value mailboxes and privileged accounts should receive additional scrutiny, especially if they can approve application consent or manage enterprise applications.
For endpoint teams, this case is also a reminder that “Microsoft traffic” is not a verdict of innocence. Correlating a suspicious Windows process with Graph requests, DNS tunneling, and unusual mailbox changes is far stronger than treating any one of those events as decisive on its own.
HOLLOWGRAPH does not create a new Microsoft 365 flaw to patch. It demonstrates that the boundary defenders must protect has moved: the calendar, the API token, the Entra application, and the DNS resolver are now all part of the same command channel.
Group-IB also reports that inbound commands and outbound files use separate RSA key pairs alongside AES-256-GCM encryption, so obtaining the cryptographic material for one direction would not necessarily expose the other. Microsoft Graph activity logs may help correlate these indicators by recording application and service-principal IDs, source IP addresses, request methods and URIs, permissions, timestamps, and response status.
The malware, dubbed HOLLOWGRAPH by Group-IB, communicates through a compromised Microsoft 365 mailbox using the Microsoft Graph API rather than directly contacting attacker-run infrastructure. As reported by The Register and detailed by Group-IB on July 20, the campaign is not exploiting a Microsoft 365 or Graph vulnerability. It is abusing the trust, permissions, and ordinary API traffic that many organizations already allow.
That distinction matters. There is no emergency Microsoft patch to deploy. The immediate work is identity investigation: reviewing compromised accounts, OAuth and Entra ID application activity, Graph permissions, calendar audit events, and suspicious DNS traffic.
A Calendar Event Becomes a Two-Way C2 Channel
HOLLOWGRAPH appears designed as a lean Windows implant rather than a broad malware toolkit. Its job is to read instructions from a calendar appointment, execute its limited tasking, and place collected files into newly created calendar events for an operator to retrieve later.The use of appointments in 2050 is a practical concealment technique. A future date keeps the entries out of the day-to-day Outlook views where users, executive assistants, and administrators might notice them. Encrypted attachments and non-obvious event subjects further reduce the chance that a casual mailbox review exposes the traffic.
According to Group-IB, the implant uses two core commands: one to retrieve tasking and one to send data. The retrieved instructions and the exfiltrated material are protected with hybrid RSA and AES-256-GCM encryption, so even an administrator who finds the events may not be able to interpret their contents without additional forensic work.
The important operational point is that the Graph requests can resemble legitimate Microsoft 365 application traffic. A conventional web proxy rule that spots a workstation repeatedly connecting to an unknown domain offers little help when the destination is Microsoft’s own cloud service and the account already has valid credentials.
DNS Keeps the Microsoft 365 Door Open
The calendar channel is only part of the design. Group-IB said HOLLOWGRAPH also uses DNS tunneling to receive and refresh Microsoft Entra ID credentials needed for continued Graph API access.That combination changes how defenders should interpret a seemingly ordinary Microsoft 365 session. Graph activity is the visible working channel, while DNS may be the bootstrap or credential-refresh path that keeps the operation alive. The malware reportedly does not encrypt that DNS-tunneling channel, potentially giving network defenders a useful detection opportunity if they retain and inspect recursive DNS logs.
The campaign’s use of Entra ID credentials also puts the incident squarely in the identity-security category. A cleaned Windows endpoint is not necessarily a cleaned environment if the associated identity, refresh tokens, OAuth grants, application registration, or mailbox permissions remain available to the attacker.
Microsoft’s own documentation makes clear why permissions deserve attention here. Graph permissions such as
Calendars.ReadWrite can permit an application to create, read, update, and delete calendar events, including across mailboxes when granted as application permissions. That capability has obvious business uses for scheduling and workflow products, but it also makes calendar behavior a meaningful signal when the app, account, device, or timing does not fit normal operations.The Campaign Is Small, Targeted, and Not Yet Firmly Attributed
Group-IB identified 12 infected systems, although only three were observed communicating with the compromised Microsoft 365 mailbox during the observation period. The earliest observed communication was June 3, 2026, and the latest was July 9, according to the firm.The available evidence points toward a narrowly targeted espionage operation focused on Israeli entities. Group-IB cited the Israeli organization associated with the compromised mailbox, the origin of malware uploads, and related Cavern framework material uploaded from Israel. That is not evidence that every Microsoft 365 tenant should expect an imminent HOLLOWGRAPH intrusion, but it is evidence that sophisticated operators are willing to repurpose business SaaS services for targeted operations.
Group-IB linked HOLLOWGRAPH to the Cavern framework with high confidence based on matching command structures and implementation details. The researchers also found similarities to Lyceum, an Iranian-linked espionage actor, but characterized that connection as low confidence. Administrators should not let the Iran angle become the story: attribution is preliminary, while the detection and containment requirements are immediate and broadly applicable.
Microsoft 365 Audit Data Is the First Place to Look
Microsoft Purview Audit can record mailbox operations including creation of items in Calendar, Contacts, Notes, and Tasks folders. Microsoft documents the relevant event asCreate, and its standard mailbox audit retention is generally 180 days, subject to licensing, configuration, and any customized retention policy.That makes a targeted historical search feasible for many organizations, particularly because HOLLOWGRAPH’s calendar artifacts reportedly share a conspicuously distant date. But a search solely for May 13, 2050 would be too narrow a response. The date is an indicator from the observed samples, not a permanent attacker requirement. Future-dated entries, encrypted or unexplained attachments, strange calendar subjects, unusual application identities, and a mismatch between the apparent creator and user behavior should all be treated as investigation leads.
A first-pass hunt should include the following:
- Review calendar-item creation, updates, and attachment activity for suspicious accounts, with particular attention to events far in the future and actions performed by unfamiliar applications.
- Inspect Entra ID sign-in logs, service principals, enterprise applications, consent grants, and recently created or modified app registrations associated with affected users or devices.
- Identify applications holding
Calendars.ReadWrite, broader Exchange mailbox permissions, or tenant-wide consent that lack a current business owner and documented purpose. - Correlate Graph API activity with endpoint telemetry and DNS logs, looking for machines making unusual DNS requests shortly before or during unusual calendar operations.
- Preserve the relevant mailbox, endpoint, Entra, Graph, Purview, proxy, and DNS evidence before deleting events or revoking access.
Blocking Graph Is Usually the Wrong Response
A blanket block on Microsoft Graph would be disruptive and unrealistic for most organizations. Microsoft 365 itself, line-of-business integrations, mobile clients, backup products, workflow systems, and security tooling can all depend on Graph. HOLLOWGRAPH succeeds precisely because it hides among traffic defenders have good reasons to allow.The more durable response is to make cloud activity attributable. Every application with mailbox or calendar access should have an owner, a documented business purpose, minimal permissions, a consent trail, and periodic review. High-value mailboxes and privileged accounts should receive additional scrutiny, especially if they can approve application consent or manage enterprise applications.
For endpoint teams, this case is also a reminder that “Microsoft traffic” is not a verdict of innocence. Correlating a suspicious Windows process with Graph requests, DNS tunneling, and unusual mailbox changes is far stronger than treating any one of those events as decisive on its own.
HOLLOWGRAPH does not create a new Microsoft 365 flaw to patch. It demonstrates that the boundary defenders must protect has moved: the calendar, the API token, the Entra application, and the DNS resolver are now all part of the same command channel.
Update: Additional details (July 20, 2026)
Group-IB identifies HOLLOWGRAPH as a .NET NativeAOT-compiled DLL and provides several additional hunting indicators. The malware uses IPv6 AAAA queries undercloudlanecdn[.]com to retrieve Entra ID configuration—including the tenant ID, client ID, client secret, and target mailbox—and stores the reconstructed values in logAzure.txt. Calendar tasking subjects follow an Event ID pattern, while exfiltration events use a Boss…ID… pattern and attachments resembling File1.txt.Group-IB also reports that inbound commands and outbound files use separate RSA key pairs alongside AES-256-GCM encryption, so obtaining the cryptographic material for one direction would not necessarily expose the other. Microsoft Graph activity logs may help correlate these indicators by recording application and service-principal IDs, source IP addresses, request methods and URIs, permissions, timestamps, and response status.
HOLLOWGRAPH: Turning Microsoft 365 Calendars into Covert Command-and-Control Channels | Group-IB Blog
Group-IB uncovers HOLLOWGRAPH, a Windows malware that abuses Microsoft Graph API to exfiltrate files and receive commands from the attacker using Microsoft 365 calendar events, and DNS tunneling to refresh credentials used in C2 communication.
www.group-ib.com
References
- Primary source: The Register
Published: 2026-07-20T14:59:00+00:00
Microsoft 365 calendars become spy drop boxes in HOLLOWGRAPH campaign
Malware hides commands in appointments set for 2050 and uses Redmond's own cloud to phone homewww.theregister.com - Related coverage: infosecurity-magazine.com
New HollowGraph Malware Hijacks Microsoft 365 Calendars for Covert C2 - Infosecurity Magazine
Researchers have linked HollowGraph malware to the Cavern framework after discovering its use of Microsoft 365 calendars and Microsoft Graph APIs as a stealthy C2 channelwww.infosecurity-magazine.com
- Related coverage: itbranschen.com
HOLLOWGRAPH utnyttjar Microsoft 365 för dolda C2-kanaler
Group-IB avslöjar HOLLOWGRAPH, en avancerad skadlig programvara som missbrukar Microsoft Graph API och Microsoft 365-kalendrar för dold kommando- och kontrolltrafik.itbranschen.com
Last edited:
