A newly uncovered Windows malware implant is abusing Microsoft 365 calendar events to receive instructions and exfiltrate stolen files, allowing its operators to conceal espionage activity inside legitimate Microsoft cloud traffic.
The malware, named HOLLOWGRAPH by Group-IB, transforms a compromised Microsoft 365 mailbox calendar into a two-way command-and-control channel. Attackers place encrypted instructions inside calendar-event attachments, while infected computers return stolen information by creating additional appointments and uploading encrypted files.
To prevent the malicious events from attracting the mailbox owner’s attention, the attackers schedule them for May 13, 2050—nearly 24 years in the future.
Group-IB said it identified at least 12 systems infected with HOLLOWGRAPH. Three were actively communicating with attacker-controlled infrastructure during the company’s observation period.
The earliest recorded exchange between a victim and the attackers occurred on June 3, 2026, and the most recent was detected on July 9. The small number of infections, selective communications and evidence connecting the activity to Israel indicate that HOLLOWGRAPH is being used in a carefully controlled espionage campaign rather than indiscriminately distributed.
The compromised mailbox used for command-and-control and data exfiltration was associated with an Israeli organisation. Group-IB also observed HOLLOWGRAPH samples and other files connected to the broader malware framework being uploaded from Israel.
While researchers found similarities to tools previously associated with Iran-linked threat actors, the identity of the group operating the campaign remains unconfirmed.
Microsoft 365 becomes part of the malware infrastructure
HOLLOWGRAPH’s defining feature is its use of the Microsoft Graph API, the legitimate interface through which applications interact with Microsoft 365 services such as Outlook, Teams, OneDrive and SharePoint.
Rather than connecting directly to a traditional command-and-control server, the implant authenticates to Microsoft’s cloud using credentials associated with a compromised Microsoft Entra ID application. It then accesses a designated mailbox and uses its calendar as a digital dead drop.
This arrangement offers significant advantages to an espionage operator. Communications with Microsoft Graph are encrypted using HTTPS and directed to trusted Microsoft infrastructure, making them much more difficult to identify through conventional network monitoring.
Security products that rely heavily on domain reputation or attempt to block connections to unknown servers may see only an infected computer communicating with an approved Microsoft service. Blocking Graph traffic outright is generally impractical because many legitimate business applications depend on the same API.
The technique also moves part of the attacker’s infrastructure into the victim’s own cloud environment. Calendar events, attachments and application activity can look superficially similar to ordinary Microsoft 365 operations unless security teams are examining the underlying mailbox and service-principal audit data.
HOLLOWGRAPH is not exploiting a vulnerability in Microsoft 365 or the Graph API. Instead, it is abusing legitimate capabilities with stolen or otherwise compromised cloud credentials. That distinction is important because installing software patches alone would not remove the attacker’s access.
Malware operates with only two commands
HOLLOWGRAPH is delivered as a .NET NativeAOT-compiled dynamic-link library. Native Ahead-of-Time compilation converts .NET code into native machine code before execution, which can complicate analysis because the resulting binary does not retain all the characteristics typically associated with ordinary managed .NET assemblies.
Despite the sophistication of its communications, the component exposes only two principal commands: get and send.
The get command retrieves instructions left by the operator. HOLLOWGRAPH queries the mailbox’s calendar for appointments scheduled between 10pm and 11pm UTC on May 13, 2050. It searches for events with subject lines beginning with Event ID: followed by a seven-character task identifier.
Once a matching event is located, the implant downloads its attachments, decrypts their contents and returns the recovered instructions to the malware component controlling it.
The send command performs the reverse operation. When another component supplies a file for exfiltration, HOLLOWGRAPH encrypts it and creates a new appointment on the same 2050 date. The encrypted information is divided into one or more attachments named according to the pattern File{n}.txt.
The malware initially gives the appointment a randomly generated identifier. After uploading the attachments, it changes the subject to a format resembling Boss{..}ID{..}, signalling to the operator that the event contains information collected from an infected system.
These calendar operations generate legitimate Graph API requests for creating an event, uploading attachments and modifying the event’s subject. The malicious nature of the traffic becomes apparent only when investigators examine the unusual date, naming patterns, application identity and attachment behaviour together.
Group-IB’s technical analysis shows that HOLLOWGRAPH invokes commands using a structured string containing separate outer and inner delimiters. It derives a seven-character task identifier from the supplied arguments, allowing the malware and its operator to associate calendar events with specific jobs or infected machines.
Separate encryption protects commands and stolen data
HOLLOWGRAPH applies an additional cryptographic layer to data stored in Microsoft 365. The implant uses a hybrid encryption design combining 2048-bit RSA-OAEP with AES-256-GCM.
AES handles the encrypted content, while RSA protects the AES key. This combines the efficiency of symmetric encryption for files with the key-management advantages of public-key cryptography.
The attackers also use separate RSA key pairs for each direction of communication. One key arrangement protects commands sent to infected systems, while another protects files returned to the operators.
Consequently, obtaining the key material used for one direction would not automatically expose traffic moving in the other. The separation also reduces the value of recovering an individual key during an investigation.
Encryption means that even administrators who discover the suspicious appointments may be unable to determine immediately what information was stolen or what instructions were issued. However, the event metadata, application activity and associated attachments can still provide valuable evidence.
DNS tunnel refreshes stolen cloud credentials
Although the primary command-and-control channel runs through Microsoft 365, HOLLOWGRAPH retains a secondary connection to attacker-operated infrastructure.
The malware uses DNS tunnelling to retrieve replacement Microsoft Entra ID credentials. It sends specially constructed requests for IPv6 AAAA records under the attacker-controlled domain cloudlanecdn[.]com.
Four configuration values can be refreshed through this channel: the Microsoft Entra tenant ID, application client ID, client secret and address of the mailbox used for communications.
HOLLOWGRAPH first sends a query to determine the length of the value it needs to retrieve. It then issues further DNS requests whose returned IPv6 addresses contain portions of the data.
Each 16-byte IPv6 response carries 14 usable bytes of payload. The malware gathers these fragments, reconstructs the complete value, decodes it as UTF-8 text and inserts it into its local configuration.
Unlike the calendar traffic, Group-IB said the credential-refresh channel itself is not encrypted. However, its data is encoded within DNS responses, potentially allowing it to pass through networks where outbound web traffic is tightly controlled but DNS requests receive less scrutiny.
The mechanism gives the operator a way to recover if Microsoft 365 credentials stop working. Client secrets can expire, be revoked or become unusable when defenders disable an application. By obtaining new authentication material through DNS, the implant can potentially restore access to its cloud-based communications without being redeployed.
The technique also creates a useful detection opportunity. Frequent AAAA queries involving long, random-looking subdomains—particularly to infrastructure not normally contacted by an organisation—can indicate DNS tunnelling.
Configuration disguised as an ordinary log file
HOLLOWGRAPH carries an embedded configuration containing the Entra tenant and application identifiers, client secret, mailbox address, DNS domain and RSA keys required for communications.
When it runs, the malware writes this information to a file called logAzure.txt, a name apparently selected to make the configuration resemble an ordinary Azure log.
The file is particularly significant for incident responders because it may contain enough information to identify the affected tenant, application and mailbox. Its presence can also help distinguish HOLLOWGRAPH from unrelated malicious activity.
However, defenders should not treat the removal of the file or malware DLL as complete remediation. If the Entra application, client secret or compromised mailbox remains accessible, the attackers may retain cloud access independently of the infected endpoint.
A full response would therefore need to address both sides of the intrusion: the Windows systems carrying the implant and the Microsoft 365 tenant being used for communications.
Links to the Cavern espionage framework
Group-IB attributes HOLLOWGRAPH with high confidence to Cavern, a modular backdoor framework in which separate plugins perform different functions.
HOLLOWGRAPH appears to provide the framework with a specialised communications and file-transfer capability rather than operating as a complete espionage platform on its own. Its limited get and send functions make sense in that context: other Cavern modules can collect files, execute tasks or interact with a compromised system, while HOLLOWGRAPH transports instructions and results.
Researchers found several technical connections between the component and Cavern, including a matching command syntax and shared command structures.
One observed command was encoded as MzU=, which decodes to 003. Group-IB identified this as a command used to toggle debug logging within Cavern. The malware also exchanged structured tasking data that matched the framework’s handling of internal or “self” commands.
These overlaps led Group-IB to conclude that HOLLOWGRAPH is likely part of a different or newly developed Cavern variant rather than an unrelated implant that happens to use similar techniques.
Possible Iranian connection remains unconfirmed
Group-IB found technical similarities between Cavern and a modular .NET backdoor previously linked to Lyceum, an Iranian-nexus espionage group also associated with the wider OilRig ecosystem.
Both toolsets use modular architectures in which individual components handle specialised jobs. In each case, commands can correspond to plugin names, with the relevant DLL loaded when the operator requests a particular capability.
However, Group-IB stressed that these characteristics are not unique enough to establish who is operating HOLLOWGRAPH. The company assessed a possible connection to Lyceum with low confidence and did not attribute the campaign to any previously identified group.
That caution is especially important in state-linked investigations. Tool similarities may result from code sharing, imitation, contractor relationships, common developers or deliberate attempts to mislead researchers. Targeting Israeli organisations is consistent with the interests of multiple Iran-aligned groups, but victimology alone is not proof of responsibility.
The stronger finding is the technical association with Cavern. The identity of the organisation deploying that framework in this campaign remains unresolved.
A highly selective espionage operation
The 12 infections identified by Group-IB represent a limited observed set and should not necessarily be interpreted as the total number of compromised devices. Visibility into espionage operations is often incomplete, particularly when malware communicates through encrypted cloud services.
Nevertheless, only three of the identified systems were actively interacting with the attackers. Researchers believe this selective engagement indicates that the operators were choosing which infected computers to task rather than automatically communicating with every available system.
Such selectivity can reduce exposure. Every command, exfiltration event and infrastructure interaction creates evidence that defenders or security researchers could discover. A disciplined operator may therefore remain quiet on lower-value infections while concentrating on systems that provide access to useful intelligence.
The observed activity between June 3 and July 9 also demonstrates that the technique was operational rather than merely experimental. Calendar events were being used to pass commands and transfer information during a live campaign.
Why trusted-cloud command channels are difficult to stop
HOLLOWGRAPH reflects a broader challenge facing enterprise defenders: many of the services attackers want to abuse are also essential to normal business operations.
Microsoft Graph traffic is common in organisations that use Microsoft 365. Applications routinely access mailboxes, calendars and files through service principals, delegated permissions and OAuth tokens. An attacker who obtains valid credentials can operate within this background of legitimate activity.
Traditional network controls may provide little context about which application made a Graph request, which mailbox it accessed or why it created an event. That information is more likely to be found in Microsoft Entra sign-in records, application audit events, Exchange mailbox logs and Microsoft 365 audit data.
The attack therefore crosses conventional security boundaries. Endpoint telemetry may show the malicious DLL and local configuration, DNS logs may reveal credential retrieval, Entra records may identify abnormal service-principal authentication, and mailbox auditing may expose the creation of calendar events. No single data source necessarily shows the entire operation.
Microsoft says mailbox auditing is enabled by default in Microsoft 365 organisations and records specified actions performed by mailbox owners, delegates and administrators. The company also recommends monitoring Entra audit logs, sign-in records and Microsoft 365 audit data when investigating application abuse. Microsoft’s mailbox-auditing documentation explains how administrators can verify the organisation-level configuration and review the actions being captured.
What defenders should look for
The most distinctive artefact is a Microsoft 365 calendar appointment scheduled for May 13, 2050, particularly during the fixed 10pm-to-11pm UTC period used by the malware.
Security teams should search for subject lines beginning with Event ID: and events following the Boss{..}ID{..} convention. Appointments initially created with GUID-only subjects, subsequently renamed and containing attachments such as File0.txt or File1.txt, also warrant investigation.
Mailbox audit records should be examined for event creation, attachment uploads and calendar-item modifications performed by an application rather than an interactive user. Investigators should correlate those operations with Entra service-principal sign-ins and token requests.
On endpoints, teams can hunt for logAzure.txt and the hashes published in Group-IB’s HOLLOWGRAPH report. Network monitoring should look for the cloudlanecdn[.]com domain, unusual volumes of AAAA queries and long or high-entropy subdomains consistent with encoded data transfer.
Administrators should also review every application with permission to read or write mailbox calendars. Permissions should follow least-privilege principles, and applications that no longer serve a documented business purpose should be disabled or removed.
Client-credential applications deserve particular attention because they can authenticate non-interactively using an application ID and secret. Microsoft recommends alerting when credentials are added to existing applications outside expected administrative processes and replacing long-lived client secrets with shorter-lived credentials, certificates or managed identities where possible. Microsoft’s Entra application security guidance classifies unexpected additions of application credentials as high-risk activity.
Microsoft also supports Conditional Access policies for workload identities, including controls that can block service-principal token requests from unapproved locations or when a workload identity is considered risky. Administrators can review this activity through the service-principal sign-in logs. Microsoft’s workload identity guidance provides further configuration details.
Response requires endpoint and cloud remediation
If HOLLOWGRAPH is discovered, defenders should isolate affected endpoints, preserve forensic evidence and determine how the implant was loaded. They should also assume that the associated Microsoft 365 identity and application credentials have been compromised.
Relevant client secrets and certificates should be revoked and replaced, active sessions and tokens invalidated where appropriate, and the permissions granted to the affected application reviewed. The designated mailbox should be examined for historical calendar artefacts, attachments and access from unfamiliar applications or locations.
Investigators should search across the tenant rather than limiting their review to a single mailbox. A service principal with broad application permissions may be capable of reaching additional users’ calendars, depending on its Graph permissions and any application-access restrictions in place.
DNS logs can help establish when the implant attempted to obtain replacement credentials, while endpoint evidence may show when logAzure.txt was created or updated. Combining these timestamps with Entra sign-ins and calendar changes can help reconstruct the intrusion.
HOLLOWGRAPH demonstrates how attackers can turn an everyday collaboration feature into an espionage channel without requiring a novel cloud vulnerability. By combining compromised Entra credentials, legitimate Microsoft Graph requests, encrypted calendar attachments and DNS tunnelling, its operators can distribute commands and remove stolen information through traffic that many organisations inherently trust.
The discovery also underlines the need to treat cloud identities, application credentials and mailbox activity as part of the security perimeter. For organisations heavily dependent on Microsoft 365, detecting the next intrusion may require looking beyond suspicious emails and sign-ins—and into appointments that nobody expects to attend until 2050.