AI Security AI安全 16h ago Updated 11h ago 更新于 11小时前 46

HollowGraph Malware Hides C2 and Stolen Files in Microsoft 365 Events Dated 2050 HollowGraph恶意软件将C2和窃取的文件隐藏在日期为2050年的Microsoft 365事件中

HollowGraph is a novel espionage implant that uses a hijacked Microsoft 365 calendar as a command-and-control channel, storing instructions and exfiltrated data in events dated to the year 2050. The malware operates as a .NET DLL with only two commands (get/send), utilizing hybrid RSA and AES-256 encryption for data in transit while avoiding direct connections to attacker-owned servers for payloads. Identity persistence is maintained via a secondary DNS-based channel that refreshes Entra ID cred 新型间谍软件HollowGraph利用微软365日历作为命令与控制(C2)通道,将指令和窃取的数据隐藏在日期为2050年的日历事件中,以规避常规监控。 该恶意软件通过合法的Microsoft Graph API流量传输数据,结合RSA和AES-256混合加密,使活动看起来像正常的业务通信,从而绕过基于目的地的网络控制。 除了日历通道外,HollowGraph还通过DNS AAAA记录从攻击者域名获取Entra ID凭据以维持访问权限,且该部分通信未加密。 该工具被高置信度关联到模块化后门框架Cavern,可能由与伊朗情报部门相关的威胁行为体(如Cavern Manticore)使用,针对特定目

65
Hot 热度
70
Quality 质量
60
Impact 影响力

Analysis 深度分析

TL;DR

  • HollowGraph is a novel espionage implant that uses a hijacked Microsoft 365 calendar as a command-and-control channel, storing instructions and exfiltrated data in events dated to the year 2050.
  • The malware operates as a .NET DLL with only two commands (get/send), utilizing hybrid RSA and AES-256 encryption for data in transit while avoiding direct connections to attacker-owned servers for payloads.
  • Identity persistence is maintained via a secondary DNS-based channel that refreshes Entra ID credentials through IPv6 AAAA records, disguised as routine log files.
  • Detection relies on identifying anomalies in Microsoft Graph API activity, such as calendar events with far-future dates, specific naming conventions, and unusual DNS query patterns.

Why It Matters

This technique represents a significant evolution in "living off the land" attacks by leveraging legitimate, high-volume SaaS infrastructure to obscure malicious activity, making traditional network perimeter defenses ineffective. It highlights the critical need for organizations to monitor application-level permissions and API usage within cloud environments like Microsoft 365, rather than relying solely on endpoint or network security tools.

Technical Details

  • Command and Control Mechanism: The implant treats the compromised mailbox's calendar as a two-way dead drop. It queries for events dated 2050-05-13 to retrieve instructions and creates similar future-dated events to upload encrypted stolen files as attachments.
  • Encryption and Architecture: HollowGraph is a .NET DLL supporting only get and send commands. All calendar traffic is wrapped in hybrid RSA and AES-256 encryption using separate key pairs for inbound and outbound data.
  • Credential Refresh Channel: A secondary channel uses DNS over IPv6 AAAA records from the domain cloudlanecdn[.]com to decode and refresh Entra ID client credentials (tenant ID, client ID, secret). These are written to a file named logAzure.txt.
  • Attribution and Context: Group-IB links the code to the Cavern backdoor framework, associated with Iranian-linked actors, though specific attribution remains unconfirmed. The campaign targeted an Israeli organization with activity observed between June 3 and July 9, 2026.

Industry Insight

  • Shift to Identity-Centric Defense: Security teams must prioritize auditing OAuth applications and client credentials accessing Microsoft Graph API, as these can be abused for stealthy C2 channels without exploiting software vulnerabilities.
  • Enhanced Cloud Monitoring: Implement detection rules for anomalous calendar activities, such as events with distant future dates, GUID-based subjects, or attachments created by service principals rather than human users.
  • DNS Anomaly Detection: Monitor for high-entropy subdomain queries and frequent AAAA record lookups directed at suspicious domains, as these may indicate covert credential refresh mechanisms or data exfiltration tunnels.

TL;DR

  • 新型间谍软件HollowGraph利用微软365日历作为命令与控制(C2)通道,将指令和窃取的数据隐藏在日期为2050年的日历事件中,以规避常规监控。
  • 该恶意软件通过合法的Microsoft Graph API流量传输数据,结合RSA和AES-256混合加密,使活动看起来像正常的业务通信,从而绕过基于目的地的网络控制。
  • 除了日历通道外,HollowGraph还通过DNS AAAA记录从攻击者域名获取Entra ID凭据以维持访问权限,且该部分通信未加密。
  • 该工具被高置信度关联到模块化后门框架Cavern,可能由与伊朗情报部门相关的威胁行为体(如Cavern Manticore)使用,针对特定目标进行间谍活动。
  • 防御重点在于身份验证和应用权限管理,建议监控异常日历事件(如未来日期、GUID主题)、应用程序驱动的邮件活动以及异常的DNS查询。

为什么值得看

这篇文章揭示了攻击者如何利用企业最常用的SaaS服务(Microsoft 365)的正常功能进行隐蔽通信,展示了“合法服务滥用”的高级威胁形态。对于安全从业者而言,它强调了从传统的网络边界防御转向身份安全和应用行为监控的重要性,提供了具体的检测指标和防御策略。

技术解析

  • C2机制:HollowGraph是一个.NET DLL,仅支持getsend两个命令。它将受害者的邮箱日历视为双向死投点,通过在日历中创建带有附件的事件来接收指令和发送窃取的文件,避免了向攻击者控制的服务器发起直接连接。
  • 数据隐藏与加密:恶意软件将任务和数据隐藏在日期为2050-05-13的日历事件中,利用人类用户极少查看如此遥远日期的心理盲区。所有通过日历传输的数据均使用RSA和AES-256混合加密,入站和出站使用不同的密钥对。
  • 凭据刷新通道:为了维持Graph API访问权限,HollowGraph通过DNS查询从cloudlanecdn[.]com域名的IPv6 AAAA记录中解码租户ID、客户端ID和密钥等凭据,并将其写入伪装成日志文件的logAzure.txt中。此通道明文传输,但用于刷新长期有效的客户端凭据而非短期访问令牌。
  • 检测指标:包括日历事件中出现的远未来日期(如2050年)、主题为GUID或特定模式(Event ID:Boss{..}ID{..})、附件名为File{n}.txt。此外,还需监控由应用程序而非用户创建的日历更改,以及指向单一域名的频繁、高熵子域名的DNS AAAA查询。

行业启示

  • SaaS安全监控需深化:攻击者正越来越多地利用合法云服务(如Outlook、OneDrive、Calendar)作为C2通道。防御者不能仅依赖网络流量分析,必须深入监控SaaS平台内的应用行为和用户活动日志,特别是自动化脚本或API调用的异常操作。
  • 身份与权限治理是关键:由于HollowGraph利用了合法的Graph API和客户端凭据,传统的漏洞修补无效。组织应严格审计和管理OAuth应用的权限,实施最小权限原则,定期轮换客户端密钥,并启用条件访问和异常令牌检测等身份安全措施。
  • 威胁情报与行为分析结合:虽然具体攻击者身份尚不明确,但通过关联代码特征(如Cavern框架)可推断其潜在背景。安全团队应将此类高级持续性威胁(APT)的技术细节纳入威胁情报库,并据此调整SIEM规则和狩猎策略,重点关注异常的时间戳、文件命名模式和DNS行为。

Disclaimer: The above content is generated by AI and is for reference only. 免责声明:以上内容由 AI 生成,仅供参考。

Security 安全