Listen to this Post
Introduction: A New Era of Cloud-Native Cyber Espionage
Cybercriminals and nation-state threat actors are constantly searching for new ways to hide their operations inside legitimate cloud services. Traditional malware often communicates with attacker-controlled servers, making suspicious network traffic easier to detect. However, modern cyber espionage campaigns are evolving rapidly by abusing trusted enterprise platforms that organizations rely on every day.
Security researchers have now uncovered one of the most innovative malware campaigns of 2026. Named HollowGraph, this sophisticated Windows malware weaponizes Microsoft’s own cloud ecosystem by transforming Microsoft 365 calendars into hidden command-and-control (C2) infrastructure. Instead of communicating with suspicious domains, the malware blends perfectly into normal Microsoft Graph API traffic, making detection significantly more difficult.
The campaign appears highly selective rather than widespread, targeting a limited number of victims associated with Israeli organizations. Researchers believe the operation demonstrates the capabilities of a well-funded and disciplined cyber espionage actor.
Researchers Discover HollowGraph Malware
Security researchers at Group-IB have identified a newly discovered malware family called HollowGraph, a sophisticated Windows backdoor that abuses the Microsoft Graph API to establish covert communication channels using Microsoft 365 calendars.
Unlike conventional malware that contacts attacker-owned infrastructure, HollowGraph leverages Microsoft’s trusted cloud services as its communication platform. Every malicious instruction and every stolen file travels through legitimate Microsoft infrastructure, making network monitoring significantly more challenging.
Researchers attribute the malware with high confidence to a variant of the Cavern backdoor framework, a modular malware platform previously associated with advanced espionage operations.
Highly Targeted Campaign Focused on Israeli Organizations
Unlike mass malware campaigns that infect thousands of random systems, HollowGraph appears to be carefully designed for precision targeting.
Group-IB identified only 12 compromised systems, indicating the attackers deliberately selected their victims rather than launching opportunistic attacks.
Several technical indicators point toward Israeli targets:
The compromised Microsoft 365 mailbox belonged to an Israeli organization.
Uploaded malware samples originated from Israel.
Additional components belonging to the Cavern framework were also uploaded from Israeli systems.
Researchers observed the earliest attacker communication on June 3, 2026, while the latest confirmed activity occurred on July 9, 2026, suggesting the campaign remained active for more than a month.
The limited victim count strongly indicates an intelligence-gathering operation rather than financially motivated cybercrime.
How HollowGraph Hides Inside Microsoft 365
One of
Traditional malware connects directly to attacker-controlled command servers. HollowGraph avoids this entirely.
Instead, it converts a Microsoft Outlook calendar into a secret communications platform.
The malware supports only two primary commands:
get
send
These seemingly simple commands enable a fully functional espionage channel without generating suspicious outbound network traffic.
The “Send” Command Steals Data Through Calendar Events
When instructed to exfiltrate data, HollowGraph creates hidden calendar appointments inside a compromised Microsoft 365 account.
Instead of ordinary meeting invitations, these appointments contain encrypted stolen files attached to the event.
Because calendar synchronization is a completely legitimate Microsoft Graph API operation, many security products may classify the traffic as normal enterprise activity.
This significantly reduces the
The Get Command Retrieves New Instructions
The opposite communication channel is equally clever.
Instead of polling malicious servers, HollowGraph periodically searches the victim’s own calendar for specially crafted appointments placed there by the attacker.
If such an appointment exists, the malware downloads the encrypted attachment containing new instructions.
This creates a fully bidirectional command-and-control infrastructure entirely hosted inside Microsoft 365.
No suspicious external infrastructure is required.
Microsoft Graph API Becomes the Hidden C2 Network
Microsoft Graph API is one of
Organizations rely on it for:
Microsoft Teams
Outlook
OneDrive
SharePoint
Exchange Online
Microsoft 365 administration
Because Graph API traffic is expected inside corporate environments, HollowGraph gains an enormous stealth advantage.
Rather than hiding malicious traffic through encryption alone, the malware hides it within completely legitimate business operations.
DNS Tunneling Supplies Authentication Credentials
Another sophisticated component involves DNS tunneling.
The malware refreshes Microsoft Entra ID (formerly Azure Active Directory) authentication credentials through DNS communications.
These refreshed credentials allow continued authentication to Microsoft Graph without requiring constant user interaction.
Although this credential channel itself is not encrypted, researchers note that Graph communications use strong cryptographic protection.
Military-Grade Encryption Protects Communications
HollowGraph secures its Graph API communications using a hybrid encryption architecture.
Researchers observed:
RSA public-key encryption
AES-256-GCM symmetric encryption
Separate RSA key pairs for inbound communications
Separate RSA key pairs for outbound communications
Using different key pairs for each communication direction significantly improves operational security and complicates forensic analysis.
Even if defenders recover one encryption key, it may not expose communications traveling in the opposite direction.
Strong Technical Links to the Cavern Framework
Although researchers could not definitively attribute HollowGraph to a previously identified threat actor, they found overwhelming technical similarities with the Cavern malware framework.
Several artifacts match earlier Cavern samples.
The malware executes commands using a structured syntax similar to:
<command>_;;<em><arg0></em>,<em><arg1></em>,_<arg2>
Researchers also observed command identifiers such as:
MzU=
which decodes to:
003
This command corresponds to a Toggle Debug Logging instruction previously documented in Cavern malware.
Observed command structures also match known Cavern task formats, including JSON task objects delivered through the covert C2 channel.
These similarities strongly suggest HollowGraph is another evolution of the Cavern toolkit.
Possible Connection to Iranian Espionage Activity
Group-IB stopped short of formally attributing the campaign to a specific threat actor.
However, researchers identified notable operational similarities with Lyceum, an Iranian-linked cyber espionage group previously associated with intelligence collection activities.
The combination of:
highly selective targeting,
advanced malware engineering,
cloud-native stealth techniques,
and Israeli-focused victimology
suggests the operation was likely conducted by a sophisticated adversary with significant financial and technical resources.
Why Cloud-Based Malware Represents the Future
Security tools have spent decades focusing on detecting malicious IP addresses, suspicious domains, and unusual outbound traffic.
HollowGraph bypasses many of these assumptions.
Instead of hiding malicious infrastructure, attackers simply eliminate their own infrastructure entirely.
Everything happens inside Microsoft.
As enterprises continue migrating workloads to cloud platforms, future malware families are increasingly likely to abuse trusted SaaS ecosystems rather than building dedicated attacker networks.
Cloud-native malware is becoming one of
Defensive Recommendations for Organizations
Group-IB recommends organizations continuously hunt for indicators associated with HollowGraph and similar cloud-based malware.
Security teams should monitor:
Microsoft Graph API activity
Microsoft 365 mailbox auditing
Calendar event creation
Attachment uploads
Subject modifications
Application-generated Outlook events
Unusual Microsoft Entra ID authentication behavior
Behavioral monitoring has become more valuable than traditional signature detection when dealing with malware that abuses trusted cloud services.
Deep Analysis
HollowGraph represents a significant shift from infrastructure-centric malware toward identity-centric cyber operations. Rather than compromising servers to host command-and-control infrastructure, attackers now exploit cloud identities that organizations inherently trust. This dramatically reduces the forensic footprint and complicates incident response.
Another important observation is the
The use of Microsoft Graph API demonstrates how enterprise APIs have become attractive attack surfaces. Security teams typically allow Graph traffic without deep inspection because blocking it would disrupt business operations. Threat actors are exploiting this trust relationship.
The integration of DNS tunneling for credential refresh also highlights a layered approach to persistence. Even if defenders interrupt one communication channel, another may restore access without immediately alerting users.
The hybrid RSA and AES-256-GCM encryption scheme indicates professional malware development practices. Separate encryption keys for inbound and outbound communication reduce the intelligence value of recovered artifacts during forensic investigations.
The suspected connection to the Cavern framework suggests long-term malware evolution rather than a one-time campaign. Mature threat actors commonly enhance existing frameworks instead of developing entirely new malware families.
Modern endpoint detection systems may struggle because HollowGraph performs many actions using legitimate Windows and Microsoft APIs. Instead of detecting malicious binaries, defenders must analyze behavioral anomalies across identity, authentication, cloud logs, and application telemetry.
Useful Detection Commands
PowerShell – Review recent calendar-related audit events
Search-UnifiedAuditLog -Operations Create,Update -RecordType ExchangeItem
PowerShell – Review Microsoft Graph application permissions
Get-MgServicePrincipal
PowerShell – Check suspicious scheduled tasks
Get-ScheduledTask
PowerShell – Review active network connections
Get-NetTCPConnection
Windows Event Logs
Get-WinEvent -LogName Security -MaxEvents 500
Microsoft Defender Advanced Hunting (KQL)
kusto
DeviceNetworkEvents
| where RemoteUrl contains graph.microsoft.com
| summarize count() by DeviceName, InitiatingProcessFileName
Exchange Online PowerShell
Search-MailboxAuditLog
Organizations should also correlate Microsoft Entra ID sign-in logs, Defender XDR telemetry, Exchange audit records, and DNS activity to identify behavioral patterns consistent with HollowGraph rather than relying on a single indicator.
What Undercode Say:
HollowGraph is one of the clearest examples of how cyber espionage is evolving beyond traditional malware infrastructure. Instead of creating suspicious servers that defenders can block, the attackers transformed Microsoft’s own cloud into their communication backbone. This approach fundamentally changes the defensive landscape.
The
Abusing Microsoft Graph API is particularly effective because enterprise environments generate millions of legitimate Graph requests every day. Distinguishing malicious calendar synchronization from normal business activity becomes extremely difficult without behavioral analytics.
Another notable aspect is operational discipline. The malware exposes only two core commands, reducing complexity while maintaining all necessary functionality. Smaller attack surfaces generally produce fewer forensic artifacts.
The apparent use of Microsoft 365 calendars as encrypted storage demonstrates that cloud collaboration tools are becoming dual-use technologies. Features designed for productivity can also become covert transport mechanisms when abused.
The
The suspected relationship with the Cavern framework suggests that threat actors increasingly maintain long-lived malware ecosystems rather than constantly inventing new families. Continuous framework evolution is more efficient and makes attribution more difficult.
Organizations should recognize that traditional perimeter security provides little protection against attacks that remain entirely inside trusted cloud services. Identity protection, behavioral analytics, and cloud telemetry are now essential security pillars.
Microsoft environments should be continuously audited for unusual Graph API activity, especially calendar modifications performed by applications instead of human users. These anomalies may become one of the earliest indicators of compromise.
Security teams should also rethink detection strategies. Blocking malicious domains is no longer sufficient when the malicious infrastructure resides on legitimate Microsoft services.
Zero Trust principles become even more relevant in this context. Every identity, every application, and every cloud request should be continuously validated rather than automatically trusted because it originates from Microsoft infrastructure.
Cloud-native malware will likely become increasingly common as organizations migrate business operations to SaaS platforms. Attackers naturally follow where valuable data resides.
The intelligence value of Microsoft 365 environments makes them attractive targets. Email, documents, calendars, Teams conversations, and SharePoint data often contain an organization’s most sensitive information.
Behavior-based detection powered by AI will likely become the primary defense against malware like HollowGraph. Static signatures alone cannot reliably distinguish malicious Graph API traffic from legitimate business operations.
Finally, HollowGraph illustrates an important cybersecurity lesson: trusted services should never be assumed to represent trusted behavior. The service may be legitimate, but the activity occurring within it may not be.
✅ Confirmed: Group-IB identified a malware family named HollowGraph that abuses the Microsoft Graph API and Microsoft 365 calendar functionality as a covert command-and-control channel. This matches the technical findings published by the researchers.
✅ Confirmed: Researchers observed 12 compromised systems between June 3 and July 9, 2026, with evidence indicating a highly targeted campaign focused on Israeli organizations rather than a large-scale opportunistic attack.
✅ Partially Confirmed: While technical similarities link HollowGraph to the Cavern malware framework and show operational overlap with the Iranian-linked Lyceum threat group, researchers have not conclusively attributed the campaign to any known threat actor. The attribution remains an informed assessment rather than definitive proof.
Prediction
(+1) Cloud providers, including Microsoft, will likely expand behavioral monitoring for Microsoft Graph API abuse, introducing more advanced anomaly detection focused on calendar manipulation, application-generated events, and suspicious Graph activity.
(-1) Threat actors are expected to develop additional cloud-native malware families that exploit Microsoft 365, Google Workspace, Slack, and other SaaS platforms, making traditional network-based detection increasingly ineffective.
(+1) Enterprise security solutions will place greater emphasis on identity analytics, cloud audit correlation, and AI-driven behavioral detection, shifting cybersecurity away from simple signature-based defenses toward continuous cloud activity monitoring.
▶️ Related Video (82% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: www.infosecurity-magazine.com
Extra Source Hub (Possible Sources for article):
https://www.instagram.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
