HollowGraph Turns Microsoft 365 Calendars Into a Dead-Drop C2 Channel
Here's the thing about cloud infrastructure that keeps me up at night: we built it to be trusted, and threat actors know it. When you give malware a legitimate Microsoft Graph API token, suddenly every calendar event, every attachment, every scheduled meeting becomes part of a command-and-control pipeline that looks like normal office productivity to any analyst glancing at logs.
That's exactly what Group-IB researchers uncovered with HollowGraph — a malicious component that treats your Exchange calendar as a dead-drop mailbox. Commands arrive in events dated May 13, 2050. Stolen data gets attached to those same entries and pulled by the attacker later. The whole thing runs through hardcoded Microsoft Entra ID credentials stored in a file called logAzure.txt, which is cleverly named to look like a routine log. I've seen worse disguises, but honestly? This is the kind of operational security that makes my EDR days feel quaint.
At least 12 systems have been infected. Three were actively communicating with the threat actor between June 3 and July 9, 2026. The targeting is narrow — Israeli organizations, espionage-focused — which tells me this isn't spray-and-pray malware. This is a precision instrument.
The broader context matters here too. As artificial intelligence cybersecurity threats continue to evolve toward more sophisticated infrastructure abuse, techniques like HollowGraph's calendar-based C2 represent exactly the kind of shift that makes traditional perimeter detection increasingly inadequate. When your C2 lives inside a calendar invite, you're not fighting malware anymore — you're fighting your own productivity stack.
Source
How the Calendar Dead-Drop Actually Works
Let me walk you through the mechanics, because this is where HollowGraph earns its name. The malware authenticates to Microsoft Graph API using credentials baked directly into its configuration file — logAzure.txt. This isn't a stolen session token or a phishing-derived cookie. It's a full Entra ID service principal setup: tenant ID, client ID, client secret, target mailbox address, C2 domain, and two RSA keys all sitting in one plaintext file.
Once authenticated, the calendar becomes the communication channel. Here's the flow:
Receiving commands (GET): HollowGraph queries the compromised mailbox for calendar events matching a specific pattern — Event ID: <7-char-taskID> — and pulls down any attachments. These events are scheduled for a one-hour window between 22:00 and 23:00 UTC on May 13, 2050. That date is so far in the future that most calendar systems won't even render it by default, which means an analyst scrolling through a user's schedule is unlikely to notice.
Sending data (SEND): When the attacker needs exfiltrated files, HollowGraph creates a new calendar event with a title formatted as Boss{..}ID{..} and attaches the stolen data. Everything gets encrypted with the public RSA key before attachment.
The encryption itself is worth noting. Group-IB reports a hybrid scheme mixing RSA and AES-256-GCM, with inbound and outbound channels cryptographically separated. So you've got asymmetric encryption for key exchange layered on top of symmetric encryption for the actual payload. It's not quantum-resistant, sure, but it's overkill for what it needs to do — and that's the point. The attacker isn't trying to break your encryption. They're trying to avoid detection.
Source
The DNS Tunneling Backchannel
Here's where things get interesting — and by interesting, I mean deeply annoying from a detection standpoint. HollowGraph maintains a second communication channel that's completely unencrypted: DNS tunneling through IPv6 AAAA record queries to cloudlanecdn.com.
This backchannel doesn't carry commands or stolen data. It refreshes credentials. When the hardcoded Entra ID details in logAzure.txt expire or get rotated by the victim's admin team, HollowGraph reaches out through DNS queries and pulls down fresh tenant ID, client ID, client secret, and mailbox address. Each IPv6 address returned encodes 14 usable payload bytes (out of 16 total), which the malware assembles and decodes as UTF-8 text.
Think about what that means for your network monitoring. A DNS query to cloudlanecdn.com looks like... well, it looks like a CDN lookup. Unless you're specifically hunting for IPv6 AAAA record queries that encode structured data in the response, this traffic blends right into normal web browsing. And since it's unencrypted, you might think "great, I can just read the payload" — except the data is encoded into DNS response addresses, not in the query itself.
This dual-channel design — encrypted Microsoft Graph for C2, unencrypted DNS for credential refresh — is a deliberate operational choice. The encrypted channel handles the sensitive stuff. The DNS channel handles the maintenance. Neither looks particularly suspicious in isolation.
Source
The Cavern Framework Connection
Here's where the story gets darker. Group-IB researchers believe HollowGraph isn't a standalone tool — it's part of the Cavern command-and-control framework, which has been previously linked to an Iranian threat actor targeting entities in Israel.
The researchers assessed with high confidence that HollowGraph is linked to the Cavern framework. But they couldn't attribute it to a known threat actor with high confidence, though their analysis identified several technical similarities with the Iranian-nexus threat actor Lyceum. So there's a connection, but it's not definitive. The evidence isn't quite strong enough to point and say "this is definitely Lyceum."
What we do know: the targeting is Israeli organizations, espionage-focused. The technical sophistication is high — Group-IB themselves noted that "HollowGraph demonstrates a high level of technical sophistication. Its use of trusted cloud infrastructure for command-and-control, hybrid encryption, DNS tunneling for credential refresh, and highly selective victim targeting collectively suggest that the threat actor possesses significant technical capabilities and operational maturity."
That's not a quote you throw around lightly in threat intel. When researchers say an actor has "operational maturity," they're describing a group that's been around long enough to refine its tradecraft, invest in custom tooling, and understand the operational security tradeoffs well enough to make choices like hiding C2 in a calendar system.
The Iranian connection matters because it places this in a broader pattern of state-sponsored espionage targeting Israeli defense, technology, and government sectors. This isn't financial crime. This is intelligence gathering with a side of infrastructure compromise.
Source
Detection and Defenses
So what do you actually do about this? Group-IB has some concrete recommendations, and they're worth taking seriously.
First, monitor Microsoft Graph and Microsoft 365 audit logs for suspicious application-driven calendar activity. I'm talking specifically about events in the far future — like May 2050 — and unusual subjects and attachments. If you see calendar events being created or modified by applications rather than users, that should trigger an investigation immediately.
Second, look for indicators such as the cloudlanecdn.com domain and the logAzure.txt file. The domain might show up in DNS logs as part of normal CDN traffic, but if you see IPv6 AAAA record queries with structured data encoded in the responses, that's a red flag. The logAzure.txt file is particularly telling because it's named to look benign, but any plaintext file containing Entra ID credentials in a user's filesystem is a problem.
Third, enforce Conditional Access policies and restrict OAuth client-credential applications. The fact that HollowGraph uses a full service principal with hardcoded credentials means that tighter OAuth governance could have made this significantly harder to execute. Audit your OAuth applications regularly — especially those with client credentials that can authenticate without user interaction.
Fourth, monitor outbound DNS for tunneling patterns. This doesn't mean just looking at query volumes. It means examining the structure of responses, particularly IPv6 AAAA records that contain encoded data rather than actual addresses.
The uncomfortable truth is that most security teams aren't doing any of this. We're monitoring for malware signatures, for known bad IPs, for phishing emails. We're not looking at calendar events created by applications. We're not examining DNS response structures for encoded payloads. And that's exactly why techniques like HollowGraph work.
Source
What This Means for the Threat Landscape
HollowGraph represents something I've been thinking about a lot lately: the erosion of the boundary between "normal" and "malicious" in cloud environments. When your C2 channel is a calendar event, you can't just block suspicious traffic. You have to understand what normal looks like in your environment and flag deviations.
This is where artificial intelligence cybersecurity threats are heading. Not just AI-powered attacks, but attacks that exploit the trust we've placed in infrastructure. The calendar system isn't broken. The encryption isn't weak. The DNS protocol isn't flawed. What's broken is the assumption that activity inside trusted infrastructure is benign.
For security teams, this means shifting from signature-based detection to behavior-based monitoring. You need to know what your users' calendar activity looks like, what applications are creating events, what DNS patterns are normal for your environment. You need to be able to spot the anomaly — a calendar event dated 24 years in the future, a DNS query with encoded data in the response.
The good news is that Microsoft 365 audit logs are detailed. The bad news is that most organizations don't monitor them closely enough to catch this kind of activity. The even worse news is that as more organizations move to cloud-first strategies, the attack surface for techniques like this only grows.
HollowGraph is a reminder that in cloud environments, the threat isn't always about breaking in. Sometimes it's about blending in so well that you become part of the furniture.