Do Son 
HOLLOWGRAPH command-and-control communication | Image: Group-IB
At a glance
| Malware family | HOLLOWGRAPH, linked with high confidence to the Cavern backdoor framework |
| Threat actor | Unattributed. Low-confidence possible link to Lyceum, an Iranian-nexus group and OilRig sub-group |
| Target / victims | Israeli entities. 12 infected systems, about three actively communicating |
| Delivery vector | Compromised Microsoft 365 account. C2 through a mailbox calendar dead-drop |
| Key capabilities | Two commands (get/send), calendar events dated 2050, hybrid RSA + AES-256-GCM, DNS tunneling credential refresh |
| Source | Group-IB Threat Intelligence |
TL;DR
HOLLOWGRAPH malware hides its command-and-control inside Microsoft 365 calendars. Group-IB found it treating a hijacked mailbox calendar as a two-way “dead drop.” The team ties the sample to the Cavern framework and a targeted campaign against Israeli organizations.
What HOLLOWGRAPH is
The Group-IB Threat Intelligence team identified a new .NET NativeAOT DLL called HOLLOWGRAPH. The malware supports only two commands, get and send. Both run entirely through trusted Microsoft cloud infrastructure. As a result, malicious traffic looks like ordinary Microsoft 365 activity.
This is a textbook case of Microsoft Graph API abuse. Rather than call attacker servers directly, the implant borrows a compromised mailbox.
Delivery
The operators worked from an already compromised Microsoft 365 account tied to an Israeli organization. From there, the calendar of that mailbox became the channel. According to Group-IB, “The calendar of a compromised mailbox serves as a two-way ‘dead drop’.” No malicious inbound server connection is needed for tasking.
Infection chain
The calendar dead-drop
The flow is simple by design. First, operators plant tasking as calendar events. Then the implant reads those events and acts. Finally, it exfiltrates stolen files by creating its own events.
Every event is dated far into the future, on 13 May 2050. This keeps the entries out of the mailbox owner’s normal view. Payloads ride along as file attachments named in a File{n}.txt pattern.
Structured tasking
The loader passes a single wide-character command string. A seven-character task identifier labels each exchange. The get command pulls and decrypts operator instructions. The send command encrypts a target file and uploads it.
Command-and-control and data exfiltration
Two channels keep HOLLOWGRAPH malware running. The first is the Graph API calendar. The second refreshes credentials over DNS.
Graph API channel
All Graph payloads use hybrid RSA-OAEP plus AES-256-GCM encryption. Notably, the malware uses separate RSA key pairs for each direction. Therefore, tasking and exfiltration stay cryptographically independent.
DNS tunneling for credentials
A second channel handles credential renewal. The implant queries an attacker-controlled domain using IPv6 AAAA records. It decodes the responses to refresh its Microsoft Entra ID (Azure AD) values. Those values then get written to an on-disk file disguised as an ordinary log. Group-IB notes this DNS channel “is not encrypted.”
Victims and scope
Group-IB identified at least 12 systems carrying the implant. Of those, only about three were actively communicating during analysis. The earliest observed contact was 3 June 2026. The most recent was 9 July 2026. This narrow footprint points to targeted espionage, not broad opportunistic activity.
Attribution: what is confirmed and what is not
Group-IB links HOLLOWGRAPH to the Cavern framework with high confidence. That link rests on a matching command format and a shared self-command code. However, the actor behind the campaign remains unknown.
The team also spotted overlaps with Lyceum, an Iranian-nexus group. Yet those overlaps are not unique enough to be decisive. Group-IB therefore assesses a Lyceum link with low confidence only. In short, treat the actor as suspected, not confirmed.
Defense and detection guidance
Perimeter tools rarely flag this traffic, since it hides inside trusted cloud services. Defenders should shift focus to identity and Graph activity.
- Audit Microsoft Graph API calls tied to calendar events, especially bulk attachment reads and writes.
- Alert on calendar events dated years in the future, such as 2050, with file attachments.
- Review Entra ID app registrations and client secrets for unexpected mailbox access.
- Watch for unusual DNS patterns, including repeated AAAA queries to a single external domain.
- Hunt for disguised local config files that store cloud credentials in plain text.
As a descriptive note on indicators, the campaign relied on a hijacked Israeli mailbox, a dedicated DNS tunneling domain, and a local credential file masquerading as a log. Blocking one channel is not enough. Because HOLLOWGRAPH malware runs two independent channels, teams should close both the Graph and DNS paths together.
Why this matters
This case shows how attackers hide inside services that enterprises already trust. Microsoft Graph API abuse gives operators cover, encryption, and reach in one package. Group-IB’s report is the primary source, and it makes the tradecraft clear. Defenders who watch identity and cloud telemetry stand the best chance of catching the next variant.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
