A previously undocumented strain of Windows malware is using Microsoft 365 calendar invites as a covert communications channel, allowing attackers to issue commands and exfiltrate stolen files from victim networks while hiding in plain sight among ordinary enterprise traffic, according to new research from the threat intelligence firm Group-IB.
The malware, dubbed HOLLOWGRAPH, was detailed by Group-IB‘s Threat Intelligence team, which said it has attributed the tool with high confidence to the Cavern backdoor framework, a modular command-and-control (C2) toolkit previously linked to Iranian-nexus activity. Researchers said the sample abuses the Microsoft Graph API via a compromised Microsoft 365 account traced to Israel, using it to blend malicious communications into legitimate cloud traffic.
A calendar as a dead drop
HOLLOWGRAPH is a lightweight implant that understands only two instructions, get and send, but carries them out entirely through trusted Microsoft cloud infrastructure rather than attacker-owned servers. Group-IB’s analysis describes the compromised mailbox’s calendar being used as a two-way dead drop: operators plant instructions by creating calendar events, and the malware exfiltrates stolen files by creating its own events with encrypted attachments.
To keep the mailbox owner from noticing anything unusual, every event created by the malware is dated far into the future, specifically 13 May 2050, with the stolen or tasking data hidden inside file attachments rather than the event body. Get requests search for events with a subject line referencing a task ID, while send operations upload encrypted data in chunks named “File{n}.txt” before renaming the event to an operator-recognisable tag.
DNS tunnelling keeps credentials fresh
Alongside the calendar-based C2 channel, HOLLOWGRAPH maintains a separate communications path used solely to refresh the Microsoft Entra ID (formerly Azure AD) credentials it needs to continue authenticating to the Graph API. Group-IB found that the malware performs DNS tunnelling, issuing IPv6 AAAA record lookups against an attacker-controlled domain, cloudlanecdn[.]com, to retrieve updated tenant IDs, client IDs, client secrets, and mailbox details, which it then writes to a configuration file on disk disguised as an ordinary log file, logAzure.txt.
According to the write-up, length-indicating queries and data-carrying queries are distinguished by naming convention, with each returned IPv6 address smuggling 14 usable bytes of payload that the malware reassembles into plaintext credential data. This DNS channel, researchers noted, is not itself encrypted.
Communications sent through the Graph API channel, by contrast, are protected with hybrid RSA and AES-256-GCM encryption, and the malware uses separate RSA key pairs for inbound tasking and outbound exfiltration, keeping the two directions cryptographically independent of one another.
Linked to the Cavern framework and possibly Lyceum
Group-IB said several technical characteristics tie HOLLOWGRAPH to the Cavern framework, including a matching command syntax and observed tasking that mirrors Cavern’s known structure, among them a “toggle debug logging” self-command used elsewhere by the framework.
The researchers stopped short of attributing the campaign to a specific, previously known threat actor, but noted overlaps with malware previously associated with Lyceum, a group considered a sub-cluster of the Iranian threat actor OilRig. Group-IB said Cavern’s modular backdoor functionality closely resembles a .NET backdoor used by Lyceum in early 2025, including shared command codes and a similar approach to loading plugin modules from disk on demand. The firm characterised this potential link as low confidence.
A small, disciplined set of victims
Group-IB said it identified at least 12 systems infected with HOLLOWGRAPH, of which only around three were actively exchanging data with the attacker at the time of analysis. The earliest observed communication between a victim and the attacker was recorded on 3 June 2026, with the most recent seen on 9 July 2026, indicating the malware has been in active use since at least early June.
Researchers said the small victim count, combined with the fact that the compromised mailbox used for exfiltration belongs to an Israeli organisation and that malware samples were uploaded for analysis from Israel, points to a deliberately narrow, targeted espionage operation rather than opportunistic mass compromise.
Why it matters
The use of legitimate cloud services for C2 is a well-established evasion tactic, but HOLLOWGRAPH’s approach of hiding both tasking and exfiltrated data inside calendar event attachments, dated decades into the future, illustrates how creatively threat actors are exploiting everyday collaboration features to slip past perimeter and email-security defences. Because the traffic runs entirely through Microsoft’s own infrastructure and a legitimately authenticated (if compromised) account, it can be difficult for defenders to distinguish from normal Microsoft 365 usage without close inspection of Graph API activity and mailbox audit logs.
Recommendations
Group-IB has urged organisations, particularly those operating in or connected to Israel, to:
- Hunt for indicators associated with HOLLOWGRAPH and the Cavern framework, including the domain cloudlanecdn[.]com and the configuration file logAzure.txt.
- Monitor Microsoft Graph API activity and mailbox audit logs for anomalous calendar operations performed by an application rather than a user, including event creation, attachment uploads and subject-line changes.
- Watch for calendar artefacts consistent with the malware, such as events dated to 2050-05-13, GUID-only subjects, or subjects following the “Event ID:” or “Boss{..}ID{..}” naming patterns with “File{n}.txt” attachments.
- Restrict, monitor and audit OAuth2 applications using client credentials, and alert on the creation of new client secrets.
- Enforce Conditional Access policies, regular credential rotation and anomalous-token detection across Microsoft 365 and Entra ID environments.
- Deploy DNS monitoring capable of spotting tunnelling activity, such as unusually frequent AAAA queries or long, high-entropy subdomains, and route outbound DNS through controlled, filtered resolvers.
Group-IB said it will continue to track the evolution of the Cavern framework, adding that the sophistication of HOLLOWGRAPH, combined with its narrow targeting, points to a capable and well-resourced adversary, even though the specific group behind the campaign remains unconfirmed. More information can be found here: https://www.group-ib.com/blog/hollowgraph-microsoft-365/
