Loading story…
Researchers have identified HOLLOWGRAPH, a previously undocumented Windows malware implant that uses the Microsoft Graph API and Microsoft 365 calendar events as a covert command-and-control and data exfiltration channel. Group-IB said the malware is a .NET NativeAOT DLL linked with high confidence to the Cavern backdoor framework and observed it in a targeted espionage campaign against Israeli organizations. Investigators saw at least 12 infected systems, with roughly three actively communicating during the analysis window, and said the operation appeared narrowly focused on Israeli-connected victims.
The malware uses a compromised Microsoft 365 mailbox as a two-way dead drop, hiding tasking and stolen data inside calendar events dated 13 May 2050 to reduce the chance of discovery. It supports only the get and send commands and protects Graph API traffic with hybrid RSA-OAEP and AES-256-GCM encryption using separate RSA key pairs for each direction. Researchers also found a secondary DNS tunneling channel over IPv6 AAAA records used to refresh Microsoft Entra ID credentials, with one report tying that activity to the attacker-controlled domain cloudlanecdn[.]com; the refreshed tokens were then stored locally in a file disguised as a log. Group-IB noted some overlap with the Iranian-linked Lyceum cluster, but said that attribution remains unconfirmed and only low confidence.
Get the actors, campaigns, and ATT&CK mapping behind it.
5 events from the most recent confirmed update back to the earliest known activity.
Researchers publicly described HOLLOWGRAPH as a previously undocumented .NET NativeAOT Windows malware implant that abuses Microsoft Graph API calendar events dated 13 May 2050 for covert command-and-control and exfiltration. Group-IB linked the malware with high confidence to the Cavern backdoor framework and noted only low-confidence overlap with Lyceum.
During its investigation, Group-IB identified at least 12 infected systems, with roughly three actively communicating during the analysis window. The activity was assessed as a narrow, targeted espionage campaign against Israeli organizations or Israeli-connected victims.
Group-IB observed HOLLOWGRAPH communicating with attacker infrastructure from early June 2026 as part of a targeted espionage operation affecting Israeli-connected victims. The malware used Microsoft 365 calendar events via the Microsoft Graph API for command-and-control and data exfiltration.
Group-IB reported active HOLLOWGRAPH communications continuing through 9 July 2026. The malware also used DNS tunneling over IPv6 AAAA records to refresh Microsoft Entra ID credentials for continued access to the compromised Microsoft 365 mailbox.
Group-IB reported that HOLLOWGRAPH activity was observed beginning on 3 June 2026 in a targeted espionage campaign affecting Israeli entities or Israeli-connected victims. The malware used compromised Microsoft 365 mailboxes and calendar events via Microsoft Graph API for command-and-control and data exfiltration.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
16 references tracked. Mallory keeps watching after this page renders.
blog.polyswarm.io
Open sourcesecurityweek.com
Open sourcecyberveille.ch
Open sourcecommunity.gurucul.com
Open sourcecyberveille.ch
Open sourcetheregister.com
Open sourceitsecurityguru.org
Open sourcegroup-ib.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that **HOLLOWGRAPH**, a Windows espionage backdoor first seen in early June 2026, is using compromised **Microsoft 365** calendar events as a two-way dead-drop command-and-control channel. The malware is delivered as a **.NET NativeAOT-compiled DLL** disguised as a Brotli library, allowing operators to hide tasking and data exfiltration inside calendar content tied to a victim's cloud environment. The backdoor protects its communications with hybrid **`RSA-OAEP`** and **`AES-256-GCM`** encryption and uses separate RSA key pairs for inbound and outbound traffic. Researchers also said HOLLOWGRAPH employs **DNS tunneling over IPv6 `AAAA` records** to refresh **Entra ID** credentials and preserve mailbox access even after secret rotation, giving attackers a resilient way to maintain control over the Microsoft 365 account and its covert C2 channel.
Jul 29, 2026
China-aligned threat group **Webworm** has expanded its espionage toolkit with two custom backdoors, **GraphWorm** and **EchoCreep**, using trusted cloud and social platforms for command-and-control. Researchers said **GraphWorm** is a Go-based implant that abuses **Microsoft OneDrive** through the **Microsoft Graph API**, creating a separate workspace for each victim and using cloud folders for tasking, file transfer, shell command execution, configurable sleep intervals, and data exfiltration. **EchoCreep** was observed using **Discord** for C2, while the group also staged malware and supporting tools from a GitHub repository masquerading as a WordPress fork. The activity reflects a broader shift by Webworm away from older RATs such as **Trochilus** and **9002 RAT** toward stealthier proxy and tunneling infrastructure, including **SoftEther VPN**, **WormFrp**, **ChainWorm**, **SmuxProxy**, and **WormSocket**. Victims span government and enterprise organizations across Asia and Europe, including entities in **Belgium, Italy, Serbia, Poland, and Spain**, as well as a university in **South Africa**; researchers also linked a compromised **Amazon S3** bucket to proxy configuration storage and exfiltrated data, including VM snapshots and government documents. Investigators observed the group using tools such as **Nuclei** and **dirsearch**, along with a script exploiting a known post-authentication RCE flaw in **SquirrelMail**, indicating active targeting of exposed web applications for initial access.
Jun 29, 2026
The Harvester APT group has deployed a new Linux variant of its **GoGra** backdoor, extending a previously documented Windows espionage toolset into a cross-platform capability aimed at targets in South Asia. Researchers from Symantec and the Carbon Black Threat Hunter Team said evidence from VirusTotal submissions and lure themes points to likely targeting in **India** and **Afghanistan**, with decoy documents referencing regional subjects such as **Zomato** and **Umrah**. The campaign delivers ELF payloads disguised as PDF files, using a dropper to display a lure document while covertly launching the backdoor. Once installed, the Linux malware uses **Microsoft Graph API** and Outlook mailboxes as a covert command-and-control channel, blending malicious traffic with legitimate cloud activity to evade perimeter monitoring. The backdoor relies on hardcoded Azure AD credentials, polls a designated Outlook folder for encrypted email tasking, executes commands through `/bin/bash`, exfiltrates results by email, and deletes messages to reduce forensic visibility. Researchers linked the Linux and Windows variants through nearly identical code, shared C2 logic, and even matching spelling mistakes in strings and function names, indicating both were likely developed by the same threat actor.
Jun 29, 2026