HOLLOWGRAPH: Microsoft 365 Calendar Dead-Drop C2 and Graph API Exfiltration

HOLLOWGRAPH is a Windows espionage implant that turns a victim's own Microsoft 365 tenant into its command-and-control and exfiltration infrastructure, abusing the Microsoft Graph API and a compromised mailbox calendar as a covert dead-drop. Group-IB links the malware with high confidence to the Cavern backdoor framework, with a lower-confidence connection to the Iranian-nexus Lyceum activity cluster, and observed it in a tightly scoped operation against Israeli entities rather than opportunistic mass compromise. The tooling is disciplined and selective: roughly a dozen infected systems, only a few actively tasked at any time, and tradecraft built around blending into sanctioned cloud traffic instead of deploying noisy custom infrastructure.

Execution and footing rest on legitimate identity and cloud primitives rather than conventional malware behavior. The payload is a .NET NativeAOT compiled DLL, shipped as self-contained native code so it slips past the process and script telemetry that normally catches managed .NET tooling. Its configuration is written to disk as logAzure.txt, a file named to pass as a benign Azure log, and it carries embedded Microsoft Entra ID credentials: a tenant ID, an application client ID, and a client secret. Using those, the implant authenticates to Entra ID as an OAuth application through the client credentials flow, obtaining an application access token that grants it app-only access to a compromised user's mailbox with no interactive sign-in or run-time user consent.

With that token the malware operates entirely through Microsoft Graph. For tasking it reads calendar events via the calendar view endpoint, filtering for machine-generated subjects and events dated far in the future, around the year 2050, so they stay out of any human's normal calendar view. To exfiltrate, it creates calendar events, uploads stolen data as encrypted event attachments split across sequential text files, and renames event subjects to operator-recognizable tags, all protected with hybrid RSA and AES encryption. A separate out-of-band channel refreshes the stolen credentials over DNS tunneling, issuing IPv6 AAAA queries with long high-entropy multi-label subdomains to a single attacker-controlled domain and decoding the answer records into new configuration values written back to logAzure.txt.

The defining tradecraft is the choice to run both directions of command-and-control inside a real, sanctioned Microsoft 365 mailbox. Calendar reads and writes by an authorized application blend into the enormous volume of legitimate Graph activity in any tenant, leaving little that looks anomalous at the network or endpoint layer, while the DNS side channel keeps credential rotation off that path entirely.