New HollowGraph Malware Abuses Microsoft 365 Calendar for C&C Communication
Malware dubbed HollowGraph abuses Microsoft 365 calendars via the Microsoft Graph API for bidirectional command-and-control (C&C) communication. Operators plant tasks as calendar events, while the implant exfiltrates stolen files by creating future-dated events (May 2050) with encrypted attachments. The attack targets Israeli entities, utilizing hybrid RSA + AES encryption and a secondary DNS tunneling channel for credential refresh. Linked to the Cavern framework and potentially the Iran-nexus
Analysis
TL;DR
- Malware dubbed HollowGraph abuses Microsoft 365 calendars via the Microsoft Graph API for bidirectional command-and-control (C&C) communication.
- Operators plant tasks as calendar events, while the implant exfiltrates stolen files by creating future-dated events (May 2050) with encrypted attachments.
- The attack targets Israeli entities, utilizing hybrid RSA + AES encryption and a secondary DNS tunneling channel for credential refresh.
- Linked to the Cavern framework and potentially the Iran-nexus threat actor Lyceum, though attribution remains low confidence.
- Configuration details, including Entra ID credentials and RSA keys, are hardcoded and written to disk as logAzure.txt upon execution.
Why It Matters
This technique demonstrates a sophisticated abuse of legitimate enterprise productivity tools, allowing attackers to blend malicious traffic with normal business operations. For security teams, it highlights the critical need to monitor Microsoft Graph API activity and calendar anomalies, as traditional network perimeter defenses may miss this application-layer exfiltration.
Technical Details
- Communication Mechanism: Uses the Microsoft Graph API to treat a compromised mailbox's calendar as a two-way dead drop; 'get' commands retrieve instructions from planted events, while 'send' commands upload data via new events.
- Evasion Tactics: Calendar events are dated far in the future (13 May 2050) to prevent detection by mailbox owners, and payloads are encrypted using hybrid RSA + AES.
- Secondary Channel: Employs DNS tunneling to refresh configurations and Microsoft Entra ID (Azure AD) credentials independently of the calendar channel.
- Persistence/Config: Hardcoded configuration containing tenant IDs, client secrets, and RSA keys is stored on disk as
logAzure.txt. - Attribution Context: Associated with the Cavern framework and suspected links to the Lyceum subgroup (OilRig/Iran MOIS), based on technical similarities despite low-confidence attribution.
Industry Insight
- Organizations must implement strict monitoring for unusual Microsoft Graph API calls, particularly those involving calendar creation or modification at extreme future dates.
- Security strategies should incorporate behavioral analytics for endpoint processes writing sensitive configuration data like Azure credentials to local files.
- Threat intelligence sharing regarding specific malware variants like HollowGraph is essential for detecting early-stage campaigns targeting specific geographic regions such as Israel.
Disclaimer: The above content is generated by AI and is for reference only.