HOLLOWGRAPH Makes Calendars A Cloud Command Channel

Group-IB disclosed HOLLOWGRAPH on July 20, 2026, describing a Windows implant that uses a compromised Microsoft 365 calendar as a two-way command channel. Operators place encrypted instructions in attachments on calendar events dated May 13, 2050. The malware retrieves those instructions through Microsoft Graph, then creates its own far-future events and attaches encrypted stolen files. A separate DNS channel refreshes the Microsoft Entra application credentials needed to keep using Graph.

This is not a Microsoft 365 vulnerability and there is no product patch that removes the risk. Group-IB identified at least 12 infected systems, with about three communicating during its observation window from June 3 through July 9. The practical response crosses four control planes: isolate and examine the infected Windows host, revoke the abused application identity, inspect the mailbox and Graph activity, and hunt the DNS indicators. Attribution should remain cautious because Group-IB linked the code to the Cavern framework with high confidence but did not confidently name the operator.

Group-IB describes HOLLOWGRAPH as a .NET NativeAOT-compiled DLL that acts as one component in a larger post-compromise toolkit. The implant has two core operations, get and send. It does not fetch tasking from a conventional attacker-hosted web server. Instead, it authenticates to Microsoft Graph and treats one compromised mailbox calendar as shared storage between the operator and infected endpoints.

The researchers identified at least 12 systems carrying the implant. About three were actively communicating with the operator during analysis, and observed victim traffic ran from June 3 to July 9, 2026. A compromised mailbox used for exfiltration was associated with an Israeli organization, and related samples were uploaded from Israel. Those facts support Group-IB's assessment of focused interest in Israeli entities, but they do not establish that every infected system belonged to one organization or explain how each endpoint was first compromised.

The public report is explicit about an important boundary: HOLLOWGRAPH abuses legitimate Microsoft cloud functions after identity and endpoint compromise. It does not exploit a Microsoft Graph or Microsoft 365 software flaw. An ordinary calendar invitation is not evidence of this malware, and administrators should not turn the specific 2050 marker into a claim that calendars themselves are unsafe.

For inbound tasking, the implant queries a narrow calendar view on May 13, 2050 and looks for a subject beginning with Event ID followed by a task identifier. It downloads File{n}.txt attachments from the matching event, unwraps an AES key with RSA-OAEP, decrypts the content with AES-256-GCM, and hands the recovered instruction to the surrounding loader. Parking the event decades ahead reduces the chance that a mailbox owner will encounter it through an ordinary calendar view.

The send path reverses the flow. HOLLOWGRAPH encrypts a target file, creates a temporary event on the same far-future date, uploads the output in one or more attachments, then changes the subject to an operator-recognizable Boss and ID pattern. Separate RSA key pairs protect inbound tasking and outbound data. Encryption hides the content from casual inspection, but the event date, attachment sequence, application identity, and create-upload-rename operation remain useful behavior signals.

This distinction matters for detection engineering. Network tools may see a valid TLS session to graph.microsoft.com, which is normal in a Microsoft 365 environment. The suspicious evidence is higher in the stack: which service principal requested the token, which mailbox it accessed, whether an application created an event far outside normal business horizons, and whether attachments were added and the subject changed in a tight sequence.

Group-IB recovered a local configuration file named logAzure.txt containing an Entra tenant ID, application client ID, client secret, target mailbox, DNS domain, and cryptographic keys. The filename is camouflage, not a Microsoft log. The malware can refresh four Graph connection values through encoded IPv6 AAAA responses from cloudlanecdn[.]com, taking 14 bytes of usable data from each response and writing the reconstructed values back to disk.

Microsoft documents this as app-only access: a service principal with administrator-consented application permissions can use the OAuth 2.0 client credentials flow to request an access token as itself, without a signed-in user. That is useful for background services, but it means a stolen client secret is not equivalent to a stolen interactive password. The app cannot complete MFA, and a valid secret can keep producing short-lived tokens until the credential, service principal, consent, or surrounding policy is changed.

Inventory therefore needs more than user accounts. Review app registrations, enterprise applications, owners, credentials, consented Graph permissions, and service-principal sign-ins. Microsoft recommends least privilege and prefers managed identities, federated credentials, or certificates over password-style client secrets where the deployment supports them. Conditional Access for workload identities can block eligible single-tenant service principals by location or risk, but it has licensing and coverage limits. It should support, not replace, credential lifecycle and permission review.

Start with the exact campaign indicators. Search endpoints for logAzure.txt and the published HOLLOWGRAPH hashes. Hunt DNS telemetry for cloudlanecdn[.]com, repeated AAAA lookups, long or high-entropy subdomains, and endpoints that resolve unusual IPv6 records even when normal application traffic goes directly to Microsoft. Preserve the raw queries before blocking the domain because they can help scope which hosts requested refreshed credentials.

In Microsoft 365, search calendars beyond the normal scheduling horizon. Group-IB recommends events dated May 13, 2050, GUID-only subjects, subjects matching the Event ID or Boss and ID conventions, and attachments named File{n}.txt. Correlate those artifacts with audit records showing an application rather than a person creating events, uploading attachments, or changing subjects. The date alone is a lead; the combination of date, attachment pattern, calling app, endpoint, and DNS evidence is much stronger.

Identity telemetry should answer when the service principal first requested tokens, from which addresses, with which Graph permissions, and whether new secrets or owners were added. Compare that timeline with endpoint execution and mailbox changes. If the tenant does not retain the necessary service-principal sign-in or mailbox audit data, record that gap as an incident finding. Trusted SaaS traffic is only useful evidence when the organization keeps identity and object-level telemetry long enough to investigate it.

Treat a confirmed HOLLOWGRAPH finding as both an endpoint compromise and a cloud identity incident. Isolate the affected host, acquire volatile and disk evidence appropriate to the organization's response plan, and identify the parent loader and other Cavern components. Blocking one DNS domain does not remove the implant or prove that a second credential set and mailbox are absent.

On the cloud side, preserve relevant Entra sign-ins, app audit history, consent state, mailbox audit records, event identifiers, attachment metadata, and token evidence before destructive cleanup. Then disable or remove the abused service principal where operationally safe, revoke its credentials and permissions, rotate the mailbox and application secrets that could have been exposed, and review owners or credentials added to related registrations. If the application was legitimate before compromise, rebuilding it with a new identity can produce a cleaner trust boundary than adding another secret to the old object.

Scope outbound data by what the infected host could read and what the mailbox received, not only by attachment filenames. HOLLOWGRAPH encrypts the stolen content and can split it across files, so content inspection may not recover the original data. File-access telemetry, endpoint collection, event sizes, attachment counts, Graph request volume, and the affected host's role can still support a defensible impact assessment.

Group-IB links HOLLOWGRAPH to the Cavern backdoor framework with high confidence because of matching command grammar and recovered tasking. Check Point separately documented Cavern as a modular .NET framework used by an Iran-nexus cluster it tracks as Cavern Manticore. Group-IB nevertheless says the HOLLOWGRAPH operator cannot be confidently attributed to a previously identified actor and rates a possible Lyceum connection only low confidence.

That layered wording should be preserved. Similar code and command formats can link tooling without proving who operated a specific sample. Israeli victim context can show targeting interest without identifying the sponsor. Defenders can use the technical relationship to widen a hunt for Cavern modules, but incident reports should separate observed artifacts, researcher assessment, and organizational conclusions.

Several practical unknowns remain public: the initial access path for the HOLLOWGRAPH systems, the complete victim count, every permission granted to the abused app, and the full set of data removed. The available evidence is still sufficient for action. Organizations using Microsoft 365 should test whether they can connect an unusual app-only token request to calendar object changes and an originating endpoint before this specific indicator ages out.