Hollowgraph malware turns Microsoft 365 calendars into secret-stealing "dead drop"
Command-and-control tool targets Israeli entities and shares technical similarities with a backdoor previously linked to the Iran-nexus threat actor Lyceum.
threat actor with “significant technical capabilities” is using new malware called HollowGraph to steal sensitive files through covert command-and-control channels hidden inside Microsoft 365 calendars.
Researchers at Group-IB found HollowGraph on systems associated with Israeli entities and identified similarities to malware previously linked to Lyceum, an Iran-associated threat group.
However, they assessed the potential connection with low confidence and said the evidence was insufficient to attribute the campaign to Lyceum or any other known actor.
Group-IB identified at least 12 systems carrying the malware, around three of which were actively communicating with the attackers during the observation period. The small number of victims and selective communications suggest a targeted espionage campaign rather than an indiscriminate attack.
The security firm wrote: “HollowGraph represents an advanced and highly targeted espionage threat."
“Its use of trusted cloud infrastructure for command-and-control, hybrid encryption, DNS tunnelling for credential refresh, and highly selective victim targeting collectively suggest that the threat actor possesses significant technical capabilities and operational maturity," researchers added.
Bad dates and compromised calendars
HollowGraph abuses the Microsoft Graph API, using a compromised mailbox’s calendar as a two-way covert channel. Attackers create calendar events containing encrypted instructions, while the malware creates events of its own and attaches encrypted stolen files.
The malware authenticates to Microsoft Graph using OAuth 2.0 credentials associated with a Microsoft Entra ID application. It stores a tenant ID, client ID and client secret, which it uses to obtain access to the compromised mailbox and its calendar.
HollowGraph can refresh those credentials through a secondary DNS-tunnelling channel, allowing the attackers to maintain access if the authentication details need to be replaced. The technique abuses valid or compromised OAuth credentials rather than exploiting a vulnerability in OAuth itself.
The events are scheduled far into the future—specifically 13 May 2050—to make them less likely to attract the mailbox owner’s attention. Attachments carry generic names such as “File0.txt”, while event subjects contain identifiers that allow the malware and its operators to locate the correct messages.
READ MORE: The DragonForce ransomware gang just gave us another huge reason to hate Microsoft Teams
Group-IB linked HollowGraph with high confidence to the broader Cavern modular malware framework, citing similarities in command structure, encryption and plugin architecture.
Cavern also shares characteristics with a .NET backdoor previously attributed to Lyceum, including comparable commands and a modular design that loads plugins from disk.
Group-IB wrote: “Based on the evidence currently available, we cannot confidently attribute this activity to any previously identified threat actor.
“However, our analysis identified several technical similarities with the Iranian-nexus threat actor Lyceum. While these overlaps are noteworthy, they are not sufficiently unique to support a high-confidence attribution. At this stage, we assess a potential link to Lyceum with low confidence.”
"This isn't malware kicking down a firewall"
Commenting on the research, Andrea Sivieri, Chief Product and Technology Officer at CoreView, said: "The important thing to understand about HollowGraph is how the attacker operates, not just the clever calendar trick.
"This isn't malware kicking down a firewall, it's an OAuth application with legitimate, app-level permissions to a mailbox, authenticating to Microsoft Graph and hiding in traffic that looks completely normal.
READ MORE: Chinese IoT ‘kill switches’ could disable Britain’s critical systems and infrastructure, MPs warn
“The original report doesn't say how the tenant was first breached, but it's clear the attacker had a trusted application identity to work with. Once an over-permissioned app or unmanaged consent exists in your tenant, defenders are at a huge disadvantage.
"The defence is upstream - governing which apps exist, what Graph permissions they hold, who can register and consent to them, and continuously catching configuration drift before it's abused."
