HollowGraph Malware Hijacks Microsoft 365 Calendars for Stealthy C2

HollowGraph Malware Exploits Microsoft Graph API for Covert C2

A sophisticated malware strain dubbed HollowGraph uses the Microsoft Graph API to transform compromised Microsoft 365 calendars into a covert command-and-control (C2) channel. According to research from Group-IB, this campaign is highly targeted, focusing on Israeli entities with a methodology that avoids direct connections to attacker-owned infrastructure. The malware, identified in 12 systems between June 3, 2026, and July 9, 2026, relies on legitimate third-party services to evade detection while executing malicious tasks.

Operational Mechanics: How HollowGraph Evades Detection

HollowGraph does not communicate with external command servers, which is its primary method for bypassing perimeter security. Instead, it utilizes the Microsoft 365 environment as a proxy. According to Group-IB, the malware supports two core commands: get and send.

• Send: The malware creates calendar appointments containing encrypted stolen files as attachments.
• Get: It searches for specific appointments planted by the operator, downloading attached instructions for further execution.

To secure this traffic, the malware employs a hybrid encryption scheme using RSA and AES-256-GCM. Distinct RSA key pairs are assigned to inbound and outbound communications. Furthermore, the malware uses DNS tunneling to refresh Microsoft Entra ID (Azure AD) credentials, ensuring the persistent authentication required to maintain the Graph API channel.

Links to the Cavern Backdoor Framework

Group-IB researchers have attributed HollowGraph to the broader Cavern backdoor framework with high confidence. This assessment is based on specific technical overlaps in command syntax and structure. The malware uses the string format _;;__,__,_ to invoke components, a signature consistent with Cavern operations.

Evidence of this link includes the observation of the MzU= command, which translates to the 003 instruction—a known debug logging toggle used by Cavern agents. The C2 tasking structure, such as {“cid”: “oXhLaJ0ZvtPb9XB”, “type”: “self”, “cmd”: “003_;;__,_”}, also mirrors documented Cavern protocols. While the specific threat actor remains unidentified, researchers noted technical similarities to the Iranian-nexus group Lyceum, citing the disciplined, narrow scope of the attacks.

Defensive Strategies and Monitoring

Because HollowGraph operates through authorized API channels, traditional network-based blocking is often ineffective. Group-IB recommends that security teams focus on behavioral indicators within the Microsoft 365 ecosystem. Organizations should audit mailbox activity for anomalous calendar operations, specifically looking for:

• Event creation performed by applications rather than individual users.
• Unusual attachment uploads to calendar items.
• Unexpected changes to event subjects.

Proactive hunting for indicators associated with the Cavern framework remains the most effective way to identify the presence of HollowGraph within an enterprise environment.

Frequently Asked Questions

What is HollowGraph?

HollowGraph is a malware sample that uses the Microsoft Graph API to turn Microsoft 365 calendars into a command-and-control channel for data exfiltration and tasking.

How does HollowGraph avoid detection?

It avoids direct connections to attacker servers, instead using trusted Microsoft infrastructure to send and receive commands, making the traffic appear legitimate.

Which entities are being targeted?

Group-IB identified that the campaign is highly targeted toward Israeli organizations, based on the location of compromised mailboxes and upload sources.

Is HollowGraph related to other malware?

Yes, researchers assess that HollowGraph is a variant of the Cavern backdoor framework due to matching command syntax and tasking structures.

---

Are you managing enterprise M365 environments? Subscribe to our weekly security briefing for the latest updates on API-based threats and detection strategies.