Loading malware…
HOLLOWGRAPH is a Windows espionage backdoor and communications component linked with high confidence to the modular Cavern backdoor framework. Implemented as a .NET NativeAOT-compiled DLL, it uses the Microsoft Graph API and a compromised Microsoft 365 mailbox calendar as a bidirectional command-and-control dead drop. It has been observed in targeted espionage activity focused on Israeli organizations since at least June 2026. Investigators identified at least 12 infected systems, approximately three of which were actively communicating during the observation period. The responsible threat actor has not been definitively identified.
HOLLOWGRAPH supports two principal operations: retrieving operator instructions and sending files. It downloads encrypted tasking from calendar-event attachments and returns decrypted instructions to its calling component. For exfiltration, it encrypts supplied files and uploads them as attachments to newly created calendar events. Malicious events are scheduled decades into the future to reduce their visibility to ordinary mailbox users. Calendar payloads are protected with hybrid RSA-OAEP and AES-256-GCM encryption, using separate RSA key pairs for inbound tasking and outbound data.
A secondary, unencrypted DNS-tunneling channel retrieves replacement Microsoft Entra ID authentication configuration through IPv6 AAAA responses. These responses carry updated tenant identifiers, application identifiers, client secrets, and mailbox information, allowing operators to restore the Graph communications channel without replacing the implant. HOLLOWGRAPH stores its configuration locally and updates it after credential refreshes. Its use of legitimate Microsoft cloud services, encrypted attachments, and future-dated calendar events conceals command traffic and exfiltration within otherwise routine enterprise activity.
4 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
“Group-IB links HOLLOWGRAPH to the Cavern framework with high confidence” and reports at least 12 infected systems, with approximately three actively communicating with attacker infrastructure.
Two back-to-back follow-up reports from Group-IB and Kaspersky detailed another module dubbed HOLLOWGRAPH that turns Microsoft 365 calendars into covert C2 channels.
Industry researchers identified HOLLOWGRAPH, a newly discovered malware component that it attributes with high confidence to the Cavern backdoor framework. Rather than relying on traditional command-and-control (C2) infrastructure, HOLLOWGRAPH abuses the Microsoft Graph API to transform a compromised Microsoft 365 calendar into a covert communications channel for receiving commands and exfiltrating stolen data.
L’article s’appuie sur l’analyse technique de Group-IB portant sur un implant nommé HollowGraph ... HollowGraph est une petite bibliothèque .NET qui exploite une boîte mail compromise pour établir un canal C2 bidirectionnel via l’API Microsoft Graph.
30 distinct techniques documented for this family, organized by ATT&CK tactic.
Researchers said the sample abuses the Microsoft Graph API via a compromised Microsoft 365 account traced to Israel
The HollowGraph malware component is designed to self-register in the Microsoft Graph API using the credentials stolen from the Microsoft 365 mailbox.
The HollowGraph malware component is designed to self-register in the Microsoft Graph API using the credentials stolen from the Microsoft 365 mailbox.
L’accès persiste via une app registration OAuth avec consentement sur la boîte mail, indépendamment du MFA.
The HollowGraph malware component is designed to self-register in the Microsoft Graph API using the credentials stolen from the Microsoft 365 mailbox.
L’accès persiste via une app registration OAuth avec consentement sur la boîte mail, indépendamment du MFA.
HOLLOWGRAPH est une DLL compilée en .NET NativeAOT
The attackers have taken measures to ensure that this file is not suspicious; specifically, it is placed in the known location used by Microsoft Entra ID and has the standard log file name.
The malware uses hybrid RSA + AES encryption to secure the payloads.
HOLLOWGRAPH is a Windows espionage backdoor delivered as a .NET NativeAOT DLL masquerading as a Brotli library.
The HollowGraph malware component is designed to self-register in the Microsoft Graph API using the credentials stolen from the Microsoft 365 mailbox.
The payloads are attached to events as files, and the events are dated far in the future (13 May 2050) to avoid alerting the mailbox owner.
The updated configuration is written to a local file named logAzure.txt, which is designed to look like an ordinary log file.
La configuration est stockée sur disque dans le fichier logAzure.txt
to retrieve updated tenant IDs, client IDs, client secrets, and mailbox details, which it then writes to a configuration file on disk disguised as an ordinary log file, logAzure.txt.
DNS tunneling over IPv6 AAAA records refreshes Entra ID credentials and preserves mailbox access after secret rotation.
L’accès persiste via une app registration OAuth avec consentement sur la boîte mail, indépendamment du MFA.
Commande send : chiffre les fichiers volés et les dépose comme pièces jointes
Instead of reaching out to attacker-controlled infrastructure for instructions, the implant rummages through calendar events, picks up encrypted tasking, and drops stolen files into new appointments for its operators to collect later.
T1560 — Archive Collected Data (Collection)
A newly identified Windows malware sample abuses Microsoft Graph API to transform a compromised Microsoft 365 calendar into a covert two-way command and control (C2) channel. | The malware supports two commands, get and send, and relies entirely on trusted third-party infrastructure for communication, never reaching out directly to attacker-owned servers for payload delivery.
The malware communicates exclusively through Microsoft Graph API requests to a compromised Microsoft 365 mailbox.
The malware, in particular, abuses the Microsoft Graph API to exfiltrate files and receive commands from the attacker using Microsoft 365 calendar events, and DNS tunneling to refresh credentials used in C2 communication.
A newly identified Windows malware sample abuses Microsoft Graph API to transform a compromised Microsoft 365 calendar into a covert two-way command and control (C2) channel.
Using the Microsoft Graph API, it treats the compromised mailbox's calendar as a two-way dead-drop: operators plant tasking as calendar events, and the implant exfiltrates stolen files by creating its own events with encrypted data attached.
Le canal C2 est classifié comme Web Service C2 dans le framework ATT&CK.
Meanwhile, the get command searches for appointments planted by the operator and downloads the attached instructions.
Commande send : chiffre les fichiers volés... Chiffrement hybride RSA-OAEP + AES-256-GCM
It decodes those values from IPv6 AAAA records sent back by an attacker domain, cloudlanecdn[.]com
Communications are protected using a hybrid cryptographic implementation combining RSA-OAEP with AES-256-GCM, with separate RSA key pairs used for inbound tasking and outbound data exfiltration.
Le trafic est chiffré avec un mix RSA + AES-256-GCM, avec des clés séparées pour les canaux entrant et sortant.
The send command generates calendar appointments with encrypted stolen files attached.
The SEND type of events is used to exfiltrate the stolen data by adding it as an attachment.
The malware, in particular, abuses the Microsoft Graph API to exfiltrate files and receive commands from the attacker using Microsoft 365 calendar events.
9 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
26 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.