A new piece of malware is showing defenders how far the “living off trusted cloud services” playbook has advanced: instead of reaching out to attacker-owned servers, it treats a compromised Microsoft 365 mailbox’s calendar as a dead drop, planting and collecting commands as ordinary calendar events. The find, published by Group-IB’s Threat Intelligence team on July 20, is the latest sign that state-linked operators are betting perimeter and network defenses will not look twice at traffic that appears to be routine Microsoft 365 activity.
How HOLLOWGRAPH Turns a Calendar Into a Dead Drop
Group-IB calls the malware HOLLOWGRAPH, a Windows implant that supports exactly two commands, get and send, and executes both entirely through the Microsoft Graph API rather than direct contact with attacker infrastructure. Once it has access to a compromised Microsoft 365 mailbox, HOLLOWGRAPH treats the mailbox’s calendar as a two way exchange point: operators plant tasking by creating calendar events, and the implant answers by creating its own events with encrypted files attached as attachments.
Every event the malware touches is dated far into the future, specifically May 13, 2050, which keeps the entries out of the mailbox owner’s normal view while still being reachable by an application querying the calendar directly. Stolen data and operator instructions are both protected with a hybrid RSA and AES-256-GCM scheme, and the malware uses separate key pairs for inbound and outbound traffic so that intercepting one direction of communication does not expose the other.
A Credential Channel That Never Touches Graph
HOLLOWGRAPH pairs its calendar channel with a second, independent mechanism for staying operational: DNS tunneling. To refresh the Microsoft Entra ID credentials it needs to keep authenticating to the Graph API, the malware resolves specially encoded subdomains of an attacker-controlled domain over AAAA (IPv6) queries, then decodes the returned addresses to rebuild its tenant ID, client ID, client secret and target mailbox. Those values are written back to a local configuration file disguised as an ordinary log. Splitting credential renewal from data exchange means the two channels can be monitored and defended against independently, but it also means an organization only watching mailbox activity, or only watching DNS, will see just half the picture.
Group-IB links HOLLOWGRAPH with high confidence to a modular backdoor toolkit it tracks as the Cavern framework, based on matching command syntax and a plugin-loading mechanism observed across samples. The researchers stop short of naming the operator: they describe tradecraft overlaps with Lyceum, an Iran-nexus group tied to the OilRig ecosystem, but rate that specific attribution as low confidence. Cavern’s name and its Iran-linked profile echo a separate campaign, Cavern Manticore, that Check Point Research tied to intrusions against Israeli government and IT targets via hijacked remote-monitoring software, though Group-IB has not asserted the two are the same operation.
A Narrow, Disciplined Target List
The campaign is small by design. Group-IB identified 12 infected systems in total, with only about three actively exchanging commands with the attacker at the time of analysis, and it traced the compromised mailbox and the malware’s upload origin to Israel. The earliest observed communication dates to June 3, 2026, and the most recent to July 9, meaning the operation has run quietly for more than a month. Researchers read the low victim count and selective engagement as evidence of a targeted espionage operation rather than an opportunistic one, the kind of restraint that tends to correlate with a well-resourced, patient operator rather than a smash-and-grab crew.
Part of a Broader Pattern, Not an Isolated Trick
HOLLOWGRAPH’s calendar dead drop is the latest entry in a pattern security researchers have been documenting across unrelated malware families this year: hiding coordination inside infrastructure a target already trusts and already permits. Financially motivated crews have used blockchain transactions as dead drops for command retrieval, and other Iran-linked implants have relied on legitimate tunneling services to blend into normal traffic. What HOLLOWGRAPH adds to that pattern is specificity: rather than a public blockchain or a generic tunnel, it embeds itself inside the exact productivity workflow, calendar invites, that a Microsoft 365 tenant’s own security tooling is least likely to flag as suspicious, because the API calls it makes are indistinguishable from routine end-user behavior at the network layer.
What It Means for the Security Leader
HOLLOWGRAPH is a reminder that “unusual outbound connection” is no longer a reliable tripwire once an attacker can route both tasking and exfiltration through Microsoft’s own infrastructure. Security teams that lean on network egress monitoring alone will not see this traffic as anomalous, because it is not leaving through anything unapproved; it is Graph API calls that look, on the wire, like a user updating their own calendar. The defense has to shift into the application layer: what is querying the calendar, whether that caller is a person or a service principal, and whether the pattern of activity, far-future events, cryptic subjects, unexplained attachments, fits how a real employee uses their calendar.
The DNS tunneling channel is the more conventional half of this story, and it is also the more catchable half. Group-IB’s own recommendations focus there: watch for unusually frequent AAAA queries and long or high-entropy subdomains, and route outbound DNS through resolvers that can filter and sinkhole known-bad infrastructure. On the identity side, the priority is auditing client-credential OAuth2 applications in Microsoft 365 and Entra ID, since HOLLOWGRAPH’s entire operation depends on holding onto one working application credential.
None of this requires new tooling most enterprises lack. It requires pointing existing Microsoft 365 audit logging and DNS monitoring at a threat model that assumes the attacker is already inside the tenant, using the platform’s own APIs as camouflage, rather than assuming a compromise will announce itself with a connection to unfamiliar infrastructure.
Defenders should hunt specifically for the C2 domain cloudlanecdn[.]com, the on-disk configuration file logAzure.txt, and calendar events with GUID-only subjects, subjects matching “Event ID:” plus a task identifier, or the pattern “Boss{}ID{}” paired with attachments named File{n}.txt, all indicators Group-IB published alongside its analysis.
Source: Group-IB
