HollowGraph Malware Hides C2 and Stolen Files in Microsoft 365 Events Dated 2050
A sophisticated espionage implant, dubbed HollowGraph, is using a hijacked Microsoft 365 calendar as its command and control channel to steal data and deliver instructions. The malware, linked to the Iranian threat group Cavern (linked to MuddyWater and Lyceum), hides its activity by planting instructions and exfiltrating files in calendar events dated far into the future (2050). Because it leverages legitimate Microsoft Graph API traffic, it’s exceptionally difficult to detect, requiring monitoring of calendar activity and DNS queries.
A newly discovered espionage implant, known as HollowGraph, is leveraging a compromised Microsoft 365 calendar as its command channel to steal data and deliver instructions. Group-IB has linked the malware to the Cavern backdoor framework, a tool attributed to an Iranian Ministry of Intelligence and Security-linked actor, specifically the group known as Cavern Manticore, which overlaps with MuddyWater and Lyceum. The implant operates by planting instructions and smuggling out stolen files as attachments on calendar events dated to the year 2050 – a tactic designed to avoid detection.
To pull tasking, HollowGraph queries the calendar for an event dated 2050-05-13, reading its instructions from an attached file. To exfiltrate, it creates a far-future event and uploads the stolen file as one or more attachments. All communication is wrapped in hybrid RSA and AES-256 encryption, with separate key pairs for incoming tasking and outgoing data.
Beyond the calendar channel, HollowGraph maintains access through a secondary, less secure channel. Over DNS, it refreshes the app's Entra ID (Azure AD) login details – tenant ID, client ID, client secret, and target mailbox – by decoding IPv6 AAAA records from a specific attacker domain, cloudlanecdn[.]com, and writing them to logAzure.txt. This channel runs in the clear, presenting a significant risk.
Group-IB has identified the implant on at least 12 machines, with only approximately three actively communicating during the analysis window, spanning from June 3rd to July 9th, 2026. The firm considers this a targeted espionage campaign rather than opportunistic crime, despite the technique's potential for wider reuse.
Notably, there are no software vulnerabilities in Microsoft products and therefore no patches are required. HollowGraph exploits a compromised account and the Graph API's normal functionality, making it exceptionally difficult to detect. Detection strategies focus on monitoring Microsoft Graph and mailbox activity for application-driven calendar changes, including events with far-future dates, subjects resembling GUIDs or operator-specific Event IDs, and attachments named File{n}.txt. Additionally, monitoring DNS for unusually frequent AAAA queries and long, high-entropy subdomains targeting cloudlanecdn[.]com and the logAzure.txt configuration file is recommended. The operator remains unidentified, and victim traffic was flowing as recently as July 9th, 2026, making those far-future calendar entries worth investigating now.