HollowGraph Malware Uses M365 Calendars for Covert C2: Analyzing AI Cybersecurity Threats

Threat actors keep finding clever ways to turn legitimate cloud tools into weaponized cover. A malware component called HollowGraph takes this trick to a quiet, unsettling extreme: it hides command-and-control (C2) traffic inside Microsoft 365 calendar events.

Discovered by threat intelligence researchers at Group-IB, HollowGraph interacts with compromised mailboxes through the Microsoft Graph API. Instead of blasting noisy web requests to unrecognized IP addresses, it schedules far-future meetings and attaches encrypted payloads directly to calendar entries. Analysts tied the implant to the Cavern C2 framework, an operational toolkit previously associated with Iranian cyber-espionage groups targeting organizations across Israel. During active monitoring between June 3 and July 9, 2026, researchers tracked at least 12 infected systems, with three actively exchanging data during that window.

HollowGraph demonstrates how modern adversaries hide in plain sight by blending malware traffic with trusted SaaS endpoints. For enterprise defenders analyzing evolving AI cybersecurity threats, this campaign exposes a critical vulnerability: when attack activity mimics ordinary office API calls, traditional perimeter firewalls notice nothing.

AI Cybersecurity Threats and M365 Calendar Dead-Drops

HollowGraph doesn't start by sending out raw network beacons. It relies on hardcoded authentication details stored on the target host inside a local file named logAzure.txt. The attacker names it to blend in with harmless system logs. Inside, the configuration file stores a Microsoft Entra ID tenant ID, application client ID, client secret, target mailbox address, C2 domain name, and a pair of RSA keys.

Once loaded, HollowGraph authenticates to Microsoft Graph and turns the victim's calendar into a silent dead-drop. Operators plant instructions by adding calendar events to the targeted account.

[Target Host] <--- (Graph API / OAuth) ---> [M365 Mailbox Calendar] <--- (Graph API) ---> [Attacker C2]
    │                                                │
    ├── Local Creds: logAzure.txt                    ├── Far-Future Events (May 13, 2050)
    └── Fallback: IPv6 DNS Tunnel                    └── Encrypted Payload Attachments

The implant interacts with the mailbox calendar using two main operations:

• GET: Scans the mailbox calendar for events titled in the exact format Event ID: <7-char-taskID>. When found, HollowGraph downloads the entry's attachment and decrypts the task using its hardcoded RSA private key.
• SEND: Packages exfiltrated host data, encrypts the payload, and posts a new calendar entry matching the title structure Boss{..}ID{..} with the encrypted stolen files attached.

To evade detection by users or administrators, the threat actor schedules these malicious calendar events for May 13, 2050. On top of that, HollowGraph restricts its command polling to a single one-hour window each day—between 22:00 and 23:00 UTC. Anyone glancing at current weekly schedules will see zero suspicious activity.

This technique mirrors broader patterns in SaaS supply chain breaches, where attackers abuse implicit cloud trust rather than breaking complex cryptographic walls.

Hybrid Encryption and Future-Dated Calendar Traps

The cryptographic architecture inside HollowGraph shows deliberate engineering aimed at stopping forensic inspection. The malware uses a hybrid encryption scheme combining asymmetric RSA keys with symmetric AES-256-GCM algorithms, keeping inbound command tasking and outbound exfiltration cryptographically separated.

Here is how the dual cryptographic pathways operate:

1. Inbound Tasking: Operators sign and encrypt command files before attaching them to far-future calendar events. HollowGraph decrypts these incoming files locally using its hardcoded RSA private key.
2. Outbound Data Exfiltration: Stolen files are encrypted with a newly generated AES-256 key created on the local machine. That AES key is then encrypted using the operator's public RSA key. Both the encrypted payload and the encrypted AES key are attached to the calendar entry created by the SEND routine.

By splitting cryptographic responsibility, the attacker ensures that even if incident responders capture the host implant and extract its local RSA private key, they cannot decrypt historic or concurrent data exfiltrated from other compromised hosts in the campaign. This operational maturity has become standard across nation-state threat actors operating in 2026.

Attackers understand that static secrets eventually fail. When static client secrets expire—a scenario frequently seen during Microsoft 365 password spraying campaigns—HollowGraph switches to a fallback mechanism to stay alive.

DNS Tunneling for Entra ID Credential Renewal

Relying solely on static credentials inside a compromised environment is risky. Secrets get rotated, app registrations get suspended, and tokens expire. HollowGraph solves this problem through a secondary, unencrypted DNS tunneling channel designed specifically for credential updates.

If primary Microsoft Graph API authentication fails, the implant falls back to querying IPv6 AAAA DNS records against the attacker-controlled domain cloudlanecdn[.]com.

The renewal process uses a precise byte assembly protocol:

• Each IPv6 address returned by the authoritative DNS server contains 16 bytes.
• HollowGraph strips off network control headers, extracting 14 usable payload bytes per DNS response.
• It stitches these 14-byte chunks into a UTF-8 text string containing updated Microsoft Entra ID tenant IDs, client IDs, client secrets, and target mailbox addresses.
• Once assembled, the malware overwrites logAzure.txt with the fresh credentials and resumes normal Microsoft Graph calendar operations.

This dual-channel structure gives HollowGraph remarkable persistence. Even if identity administrators revoke app permissions or rotate secrets, the malware silently pulls down new credentials over standard outbound DNS queries without generating web proxy alerts.

Tactical Defenses and Security Best Practices

Catching HollowGraph requires security teams to move beyond network-edge inspection. As security intelligence reports from IBM and advisory guidance from CISA point out, relying on traditional endpoint detection tools won't catch malicious activity that looks like legitimate cloud API traffic. Securing modern cloud environments demands complete, multi-layered visibility across identity, host artifacts, and API telemetry.

Defenders should implement these core security practices immediately:

• Audit Far-Future Calendar Events: Query Microsoft 365 tenant logs for calendar entries created with start dates decades into the future (such as May 13, 2050) or matching subject patterns like Event ID: or Boss.
• Restrict Entra ID Application Permissions: Audit OAuth client credentials and application-level Graph API permissions (especially Calendars.ReadWrite). Enforce Conditional Access policies to restrict where and how application credentials authenticate.
• Inspect Host Artifacts and Outbound DNS: Scan endpoints for unmapped files named logAzure.txt. Build EDR and DNS monitoring rules to detect anomalous high-frequency IPv6 AAAA record requests directed to domains like cloudlanecdn[.]com.
• Monitor API Anomaly Patterns: Correlate Microsoft 365 audit logs for unusual spikes in calendar item creation, particularly during off-hours polling windows (such as 22:00–23:00 UTC).

As malicious actors integrate agentic tools into offensive workflows, security teams must evolve their threat-hunting routines. Enterprise protection is not achieved through a simple, one-time setup tutorial. Mitigating artificial intelligence AI cybersecurity threats and maintaining real-time AI agent security requires continuous verification of every cloud identity, application secret, and API transaction across the enterprise.