Listen to this Post
Introduction: When a Calendar Becomes a Cyber Weapon
For decades, cybersecurity professionals have focused on suspicious domains, malicious executables, phishing emails, and command-and-control (C2) servers hidden across the internet. However, modern threat actors are rapidly abandoning traditional infrastructure in favor of abusing trusted cloud services that organizations rely on every day.
A newly discovered malware family named HOLLOWGRAPH demonstrates exactly how sophisticated cyber espionage has become. Instead of communicating with attacker-controlled servers that can be blocked or detected, the malware transforms a legitimate Microsoft 365 calendar into a hidden communication platform. Every stolen file, every command, and every response travels through Microsoft’s own trusted cloud ecosystem, making detection significantly more difficult.
Researchers at Group-IB believe this malware belongs to an Iranian-linked cyber espionage operation associated with the Cavern malware framework. Rather than conducting broad ransomware attacks or mass infections, HOLLOWGRAPH appears to focus on carefully selected victims, particularly organizations connected to Israel, indicating a highly targeted intelligence-gathering campaign.
HOLLOWGRAPH at a Glance
HOLLOWGRAPH is a Windows malware sample compiled using .NET NativeAOT, allowing it to execute efficiently while leaving a relatively small forensic footprint.
Unlike many modern malware families that contain dozens of capabilities, HOLLOWGRAPH intentionally remains minimalistic. It only understands two primary commands:
get – Retrieve encrypted commands hidden inside Microsoft 365 calendar events.
send – Encrypt stolen information and upload it back into calendar event attachments.
This simplicity is actually one of its strengths. With fewer components, there are fewer behavioral indicators available for security products to identify.
How Microsoft 365 Calendars Become Command-and-Control Servers
Instead of connecting to suspicious IP addresses, attackers compromise a Microsoft 365 account and begin creating calendar events.
These calendar events are not intended for human users.
Each event contains encrypted instructions waiting for infected computers.
Once the malware executes, it uses the Microsoft Graph API to retrieve those events exactly as any legitimate enterprise application would.
After decrypting the instructions, the malware performs the requested actions before encrypting any stolen information and uploading it back into the calendar as attachments.
From
To many security products, the communication appears completely legitimate.
Future-Dated Events Hide the Attack
One particularly clever aspect of HOLLOWGRAPH is how it conceals malicious calendar entries.
Instead of creating events for
13 May 2050
Because these events are decades into the future, normal users are extremely unlikely to encounter them while checking their calendars.
The malware also stores stolen information inside attachments named:
File1.txt
File2.txt
File3.txt
To an automated system, these appear to be harmless text files attached to distant calendar appointments.
Encryption Protects Every Stage of Communication
HOLLOWGRAPH protects its communications using modern cryptography.
Researchers observed a hybrid encryption model built upon:
RSA-OAEP
AES-256-GCM
Interestingly, the malware separates inbound and outbound communications using different RSA key pairs.
This means:
Commands from attackers use one encryption path.
Stolen data uses another.
Even if defenders recover one encryption key, the opposite communication channel remains protected.
This significantly complicates incident response and forensic analysis.
DNS Tunneling Keeps Authentication Alive
The malware contains another sophisticated capability.
Rather than hardcoding authentication credentials, it refreshes Microsoft Entra ID (formerly Azure AD) credentials through DNS tunneling.
Specifically, HOLLOWGRAPH performs IPv6 AAAA DNS queries against the attacker-controlled domain:
cloudlanecdn[.]com
The DNS responses contain encrypted configuration values including:
Tenant ID
Client ID
Client Secret
Target mailbox
After decoding these values, the malware stores them inside a disguised configuration file named:
logAzure.txt
To an inexperienced analyst, this file may appear to be an ordinary application log.
Links to the Iranian Cavern Framework
Group-IB identified multiple technical characteristics connecting HOLLOWGRAPH with the Cavern espionage framework.
Among the strongest similarities were:
Matching command syntax
Plugin architecture
Communication methods
Shared operational behavior
Similar debugging commands
One notable command, encoded in Base64 as 003, enables or disables debug logging exactly as observed in Cavern operations.
Researchers therefore assess with high confidence that HOLLOWGRAPH represents another variant of the Cavern malware ecosystem.
Possible Connection to
Researchers also noticed structural similarities between Cavern and another .NET backdoor previously attributed to Lyceum, a subgroup associated with the Iranian threat actor OilRig.
Both malware families rely upon:
Modular plugins
Dynamic loading mechanisms
Similar architectural design
However, Group-IB stresses that this relationship currently carries only low confidence, meaning additional evidence is required before making a definitive attribution.
A Focused Espionage Campaign
Unlike ransomware campaigns that infect thousands of organizations simultaneously, HOLLOWGRAPH appears highly selective.
Researchers identified:
12 infected systems
Approximately 3 actively communicating victims
The earliest confirmed attacker communication occurred on:
June 3, 2026
The latest observed communication occurred on:
July 9, 2026
This timeline indicates that the operation remained active for weeks while maintaining an extremely limited victim set.
Such restraint is a hallmark of intelligence-focused cyber operations rather than financially motivated cybercrime.
Evidence Suggests Israeli Targets
Several indicators suggest that this campaign focused primarily on Israeli organizations.
Evidence includes:
A compromised Microsoft 365 mailbox located in Israel.
Malware samples uploaded from Israeli systems.
Operational infrastructure linked to Israeli victims.
Although attribution in cyberspace is always complex, the available technical evidence strongly supports the assessment that the operation targeted Israeli entities for intelligence collection.
How Organizations Can Detect HOLLOWGRAPH
Group-IB recommends hunting for several indicators of compromise.
Organizations should monitor for:
The domain cloudlanecdn[.]com
The file logAzure.txt
Unusual Microsoft Graph API activity
Suspicious OAuth2 application registrations
Unexpected client secret creation
Mailbox audit anomalies
Calendar events dated 2050-05-13
GUID-only calendar subjects
Event names matching patterns such as:
Event ID
Boss{..}ID{..}
Security teams should also inspect applications interacting with Microsoft Graph rather than focusing exclusively on user-generated calendar activity.
Known Indicators of Compromise (IOCs)
Network Indicator
cloudlanecdn[.]com
SHA-256 Hashes
75e51774b8f79e5f256eaae639635f911b3e744d4774fd6068dd980255621509
f3f3006f8304788251b153d53b305322b8acab0c66ec816b8d9f101bcc851da3
b3d0f6e4e3be395fd7cf9e8101c89963d77216578cbb117a6ac9bc3564485eff
The indicators remain intentionally defanged to prevent accidental communication with malicious infrastructure.
Deep Analysis
HOLLOWGRAPH reflects a broader transformation in modern cyber espionage. Traditional malware depended on attacker-owned command-and-control servers that defenders could block through firewall rules, IP reputation feeds, or domain blacklists. This malware abandons that model entirely by embedding itself within Microsoft’s trusted cloud ecosystem.
From a
Security teams should shift from simply inspecting network destinations to analyzing user behavior, OAuth permissions, application identities, and Graph API usage patterns. Detection must emphasize anomalies—such as applications creating calendar events decades into the future or repeatedly uploading attachments to obscure mailbox entries—rather than relying solely on known malicious infrastructure.
Threat Hunting Commands
PowerShell – Search for suspicious calendar-related Graph activity
Get-WinEvent -LogName "Microsoft-Windows-PowerShell/Operational"
PowerShell – Review recently registered Azure applications
Get-MgApplication
PowerShell – Search for suspicious files
Get-ChildItem -Path C:\ -Recurse -Filter logAzure.txt
Microsoft Defender Advanced Hunting (KQL)
DeviceFileEvents
| where FileName == logAzure.txt
Microsoft Defender (KQL)
CloudAppEvents
| where Application == Microsoft Graph
Microsoft Sentinel
AuditLogs
| where OperationName contains “Add service principal credentials”
Microsoft 365
OfficeActivity
| where Operation contains Calendar
These hunting techniques should be integrated into continuous monitoring alongside behavioral analytics and mailbox auditing to detect cloud-native command-and-control activity.
What Undercode Say:
HOLLOWGRAPH is another reminder that cybersecurity has entered the cloud-first era.
The malware barely resembles traditional Windows backdoors.
Instead of hiding on obscure VPS servers, it hides inside Microsoft 365.
That strategy dramatically reduces attacker exposure.
Most organizations inherently trust Microsoft Graph traffic.
Security products frequently whitelist cloud communications.
Attackers understand enterprise trust relationships better than ever.
Using calendar events as encrypted mailboxes is remarkably innovative.
Scheduling every event in the year 2050 is equally clever.
Many users never inspect distant calendar entries.
Traditional IOC-based detection will struggle against this malware.
Behavioral analytics becomes the primary defense.
OAuth application monitoring should become routine.
Mailbox auditing deserves far more attention than many organizations currently provide.
Cloud identity security is no longer optional.
Microsoft Entra ID should receive the same protection as domain controllers.
DNS tunneling remains an effective covert channel.
IPv6 monitoring continues to be overlooked in many enterprises.
Threat actors are exploiting those blind spots.
The
NativeAOT compilation further complicates reverse engineering.
Its encryption design demonstrates careful operational planning.
Separate cryptographic channels increase resilience.
This is clearly not commodity malware.
The victim count indicates espionage rather than mass monetization.
Targeted campaigns are often harder to discover.
Cloud abuse will likely increase across all major SaaS platforms.
Security operations centers must adapt accordingly.
Graph API telemetry should become part of every SOC dashboard.
Calendar activity should no longer be considered harmless.
Every trusted platform can become an attack surface.
Identity has become the new network perimeter.
Cloud-native malware will continue evolving.
Future campaigns may leverage Teams, SharePoint, OneDrive, or Exchange in similar ways.
Organizations that rely solely on perimeter security will increasingly struggle.
Continuous monitoring, Zero Trust principles, and behavioral detection are becoming essential defensive strategies.
HOLLOWGRAPH is less about malware innovation alone and more about demonstrating how trusted business services can be transformed into stealthy espionage infrastructure.
✅ Verified: Group-IB attributes HOLLOWGRAPH with high confidence to a variant of the Cavern framework based on malware behavior, command syntax, and architectural similarities.
✅ Verified: The malware abuses the Microsoft Graph API and Microsoft 365 calendar events for encrypted command-and-control, representing a legitimate cloud abuse technique observed in modern cyber espionage.
⚠️ Partially Verified: While technical indicators point toward Iranian-linked operators and Israeli-focused targeting, attribution in cyberspace is inherently probabilistic. Group-IB expresses high confidence for the Cavern linkage but only low confidence regarding a direct connection to the Lyceum subgroup of OilRig.
Prediction
(+1) Cloud providers will continue expanding security telemetry for Microsoft Graph API activity, making it easier for defenders to identify suspicious application behavior without disrupting legitimate business workflows.
(-1) Threat actors are likely to expand this technique beyond Outlook calendars, abusing other trusted Microsoft 365 services such as Teams, OneDrive, SharePoint, and Exchange Online to create even more resilient and difficult-to-detect command-and-control channels. These cloud-native tactics will challenge organizations that still rely primarily on signature-based detection and traditional network perimeter defenses.
▶️ Related Video (80% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: cyberpress.org
Extra Source Hub (Possible Sources for article):
https://www.pinterest.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
