A newly discovered espionage implant has been using a hijacked **Microsoft 365** calendar as its command channel, planting operator instructions and smuggling out stolen files as attachments on calendar events dated to the year 2050. **Group-IB**, which named the malware **HollowGraph**, says the approach moves tasking and stolen data through legitimate **Microsoft Graph API** traffic. This makes the activity appear as ordinary **Microsoft 365** chatter, effectively bypassing network controls designed to flag attacker-owned destinations. ### How HollowGraph Operates The implant is a .NET DLL that supports just two commands: `get` and `send`. Crucially, it never communicates directly with an attacker-owned server for payloads. Instead, it utilizes the compromised mailbox's calendar as a two-way dead drop. To retrieve tasks, **HollowGraph** queries the calendar for an operator-planted event, specifically at `2050-05-13`. This far-future date ensures the mailbox owner is highly unlikely to stumble upon it. Instructions are then read from an attached file. For exfiltration, the malware reverses the process: it encrypts the stolen file, creates its own far-future event, and uploads the data as one or more attachments. All data moving through the calendar is wrapped in hybrid RSA and AES-256 encryption, using separate key pairs for incoming tasking and outgoing data. ### The DNS Backdoor A secondary, less subtle channel maintains the **Graph API** access. Over DNS, **HollowGraph** refreshes the application's **Entra ID** (**Azure AD**) login details, including its tenant ID, client ID, client secret, and target mailbox. These values are decoded from IPv6 AAAA records sent back by an attacker domain, `cloudlanecdn[.]com`, and then written to `logAzure.txt`, a file disguised as a routine log. Unlike the calendar traffic, this channel runs in the clear and stores client-credentials, not access tokens. ### Attribution and Scope **Group-IB** ties **HollowGraph** to **Cavern** with high confidence, citing shared command syntax and matching internal tasking. **Cavern** is a modular backdoor framework that **Check Point** documented earlier this month, attributing it to an Iranian Ministry of Intelligence and Security-linked actor it calls **Cavern Manticore**, which overlaps with known Iranian groups **MuddyWater** and **Lyceum**. However, **Group-IB** refrains from directly naming the operator behind this specific campaign, stating, "Based on the evidence currently available, we cannot confidently attribute this activity to any previously identified threat actor." They noted only a low-confidence overlap with **Lyceum**, a subgroup of the Iranian actor **OilRig**. The compromised exfiltration mailbox belonged to an Israeli organization, but **Group-IB** considers this victim geography rather than definitive attribution. The implant was found on at least 12 machines, with victim traffic observed from June 3 to July 9, 2026. This small, selective footprint suggests targeted espionage rather than opportunistic crime, despite the technique's potential for wider reuse. It's crucial to understand that **HollowGraph** does not exploit a **Microsoft** software vulnerability. Instead, it leverages a compromised account and the legitimate functionality of the **Graph API**, making it inherently difficult to detect. The focus for defense lies in identity and application permissions, coupled with robust monitoring, rather than deploying a patch. ### What to Watch For **Group-IB's** detection advice highlights the malware's unique habits. The strongest indicators are found within the calendar itself. Security professionals should hunt for events that carry: * A far-future date, specifically `2050-05-13`. * A subject that is a bare GUID, or matches the operator's `Event ID:` or `Boss{..}ID{..}` naming convention. * Attachments named `File{n}.txt`. On the identity front, **Group-IB** recommends restricting and auditing client-credential OAuth applications that can access **Graph API**, and alerting on newly created client secrets. Standard **Entra ID** hygiene, including Conditional Access, credential rotation, and anomalous-token detection, remains critical. For broader detection, audit **Microsoft Graph** and mailbox activity for application-driven calendar changes, such as events created, attachments uploaded, or subjects renamed by an application rather than a human user. Monitor DNS for unusually frequent AAAA queries and long, high-entropy subdomains targeting a single domain. A quick first pass involves hunting for `cloudlanecdn[.]com` and the `logAzure.txt` configuration file. The full set of indicators, including file hashes, is available in **Group-IB's** comprehensive report. Hiding command-and-control within trusted **Microsoft** services is not a new tactic; attackers have previously used **Outlook** inboxes, draft folders, and **OneDrive**. Parking events in the year 2050, in a location no one typically inspects, is simply the latest evolution of this technique. Given that victim traffic was flowing as recently as July 9, a review of those far-future calendar entries is warranted now.