HollowGraph hides M365 C2 in calendar events dated 2050

The command channel is a calendar. The dead drop is an event dated 13 May 2050, sitting in a compromised Microsoft 365 mailbox that no user will ever scroll to.

Group-IB, in a report published this week, names the implant HollowGraph — a .NET DLL whose entire operator interface is two verbs, get and send, spoken through the Microsoft Graph API against a mailbox the attacker already owns. Tasking arrives as calendar events; stolen files leave as attachments on further-future events the malware itself creates. No custom protocol on the wire. No exotic port. Nothing to block that isn’t already graph.microsoft.com traffic that every other Office endpoint on the network is also emitting.

That last part is why the technique reads as infrastructure and not novelty. Microsoft’s Graph endpoint is legitimate management plane — calendars, files, users, mail — and once the operator has a working set of Entra ID credentials for the mailbox, every request the implant makes is indistinguishable from a well-behaved add-in. The tenant ID, client ID, client secret, and target mailbox live cleartext on the host in a file named logAzure.txt. If those credentials ever expire, HollowGraph refreshes them out-of-band by parsing IPv6 AAAA records from cloudlanecdn[.]com — Entra secrets encoded as address bytes, delivered over recursive DNS. Again, no port, no header, no signature. Just DNS answering questions the way DNS always answers questions.

Payloads on the wire are wrapped in a hybrid RSA/AES-256 scheme with separate keypairs for the inbound and outbound directions, so a defender who catches one attachment cannot decrypt the tasking that produced it, and vice versa.

Group-IB counts at least twelve infected machines and a compromised mailbox belonging to an Israeli organization, with the active C2 window running roughly 3 June to 9 July 2026. Twelve is small; the discipline behind it is not. This is targeted espionage, not opportunistic crime, and the implant’s code overlaps with the Cavern modular backdoor framework — a family Check Point has previously linked to a cluster it tracks as Cavern Manticore and associates with Iran’s Ministry of Intelligence and Security. Group-IB itself is careful on attribution: “Based on the evidence currently available, we cannot confidently attribute this activity to any previously identified threat actor.” A low-confidence overlap with Lyceum/OilRig sits in the report as a data point, not a conclusion.

There is no vulnerability here, and no patch. Microsoft’s calendar API is doing exactly what it advertises. What HollowGraph exploits is the audit gap between “this Graph API call happened” and “this Graph API call is anomalous” — a gap most tenants aren’t instrumented to close, because in normal operation the same endpoint services Outlook mobile, Teams, meeting-scheduling bots, and every third-party app the org has ever consented to.

If you are hunting for this in your own tenant, three specifics are worth pinning to a detection rule. Calendar events dated 2050-05-13 in any mailbox are the primary tasking marker; a bare GUID as an event subject, or subjects matching the patterns Event ID: and Boss{..}ID{..}, are the secondary one; attachments named File{n}.txt on far-future events are the exfil channel. The audit log will show Graph API calls from an app registration you did not authorize, against a mailbox that has no business talking to that app. Look there.

The physical layer under this attack isn’t a wire — it’s a contract. Microsoft Graph promises a certain shape of behavior, and HollowGraph is inside that shape. Detection has to live at the same layer: what apps are consented into your tenant, which of them touch calendars, and whether any of those calendars contain events no human ever created.