HollowGraph Malware Hides C2 and Stolen Files in Microsoft 365 Events Dated 2050
HollowGraph is a novel espionage implant that uses a hijacked Microsoft 365 calendar as a command-and-control channel, storing instructions and exfiltrated data in events dated to the year 2050. The malware operates as a .NET DLL with only two commands (get/send), utilizing hybrid RSA and AES-256 encryption for data in transit while avoiding direct connections to attacker-owned servers for payloads. Identity persistence is maintained via a secondary DNS-based channel that refreshes Entra ID cred
Analysis
TL;DR
- HollowGraph is a novel espionage implant that uses a hijacked Microsoft 365 calendar as a command-and-control channel, storing instructions and exfiltrated data in events dated to the year 2050.
- The malware operates as a .NET DLL with only two commands (get/send), utilizing hybrid RSA and AES-256 encryption for data in transit while avoiding direct connections to attacker-owned servers for payloads.
- Identity persistence is maintained via a secondary DNS-based channel that refreshes Entra ID credentials through IPv6 AAAA records, disguised as routine log files.
- Detection relies on identifying anomalies in Microsoft Graph API activity, such as calendar events with far-future dates, specific naming conventions, and unusual DNS query patterns.
Why It Matters
This technique represents a significant evolution in "living off the land" attacks by leveraging legitimate, high-volume SaaS infrastructure to obscure malicious activity, making traditional network perimeter defenses ineffective. It highlights the critical need for organizations to monitor application-level permissions and API usage within cloud environments like Microsoft 365, rather than relying solely on endpoint or network security tools.
Technical Details
- Command and Control Mechanism: The implant treats the compromised mailbox's calendar as a two-way dead drop. It queries for events dated 2050-05-13 to retrieve instructions and creates similar future-dated events to upload encrypted stolen files as attachments.
- Encryption and Architecture: HollowGraph is a .NET DLL supporting only
getandsendcommands. All calendar traffic is wrapped in hybrid RSA and AES-256 encryption using separate key pairs for inbound and outbound data. - Credential Refresh Channel: A secondary channel uses DNS over IPv6 AAAA records from the domain
cloudlanecdn[.]comto decode and refresh Entra ID client credentials (tenant ID, client ID, secret). These are written to a file namedlogAzure.txt. - Attribution and Context: Group-IB links the code to the Cavern backdoor framework, associated with Iranian-linked actors, though specific attribution remains unconfirmed. The campaign targeted an Israeli organization with activity observed between June 3 and July 9, 2026.
Industry Insight
- Shift to Identity-Centric Defense: Security teams must prioritize auditing OAuth applications and client credentials accessing Microsoft Graph API, as these can be abused for stealthy C2 channels without exploiting software vulnerabilities.
- Enhanced Cloud Monitoring: Implement detection rules for anomalous calendar activities, such as events with distant future dates, GUID-based subjects, or attachments created by service principals rather than human users.
- DNS Anomaly Detection: Monitor for high-entropy subdomain queries and frequent AAAA record lookups directed at suspicious domains, as these may indicate covert credential refresh mechanisms or data exfiltration tunnels.
Disclaimer: The above content is generated by AI and is for reference only.