Loading story…
Researchers reported that HOLLOWGRAPH, a Windows espionage backdoor first seen in early June 2026, is using compromised Microsoft 365 calendar events as a two-way dead-drop command-and-control channel. The malware is delivered as a .NET NativeAOT-compiled DLL disguised as a Brotli library, allowing operators to hide tasking and data exfiltration inside calendar content tied to a victim's cloud environment.
The backdoor protects its communications with hybrid RSA-OAEP and AES-256-GCM encryption and uses separate RSA key pairs for inbound and outbound traffic. Researchers also said HOLLOWGRAPH employs DNS tunneling over IPv6 AAAA records to refresh Entra ID credentials and preserve mailbox access even after secret rotation, giving attackers a resilient way to maintain control over the Microsoft 365 account and its covert C2 channel.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
HOLLOWGRAPH, a Windows espionage backdoor delivered as a .NET NativeAOT-compiled DLL masquerading as a Brotli library, was first observed in early June 2026. The malware uses compromised Microsoft 365 calendar events as a dead-drop command-and-control channel and can use DNS tunneling over IPv6 AAAA records to refresh Entra ID credentials.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcepicussecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers have identified **HOLLOWGRAPH**, a previously undocumented Windows malware implant that uses the **Microsoft Graph API** and Microsoft 365 calendar events as a covert command-and-control and data exfiltration channel. Group-IB said the malware is a **.NET NativeAOT DLL** linked with high confidence to the **Cavern** backdoor framework and observed it in a targeted espionage campaign against Israeli organizations. Investigators saw at least **12 infected systems**, with roughly three actively communicating during the analysis window, and said the operation appeared narrowly focused on Israeli-connected victims. The malware uses a compromised Microsoft 365 mailbox as a two-way dead drop, hiding tasking and stolen data inside calendar events dated **13 May 2050** to reduce the chance of discovery. It supports only the `get` and `send` commands and protects Graph API traffic with hybrid **RSA-OAEP** and **AES-256-GCM** encryption using separate RSA key pairs for each direction. Researchers also found a secondary **DNS tunneling** channel over IPv6 `AAAA` records used to refresh Microsoft Entra ID credentials, with one report tying that activity to the attacker-controlled domain `cloudlanecdn[.]com`; the refreshed tokens were then stored locally in a file disguised as a log. Group-IB noted some overlap with the Iranian-linked **Lyceum** cluster, but said that attribution remains unconfirmed and only low confidence.
Aug 11, 2026
The Harvester APT group has deployed a new Linux variant of its **GoGra** backdoor, extending a previously documented Windows espionage toolset into a cross-platform capability aimed at targets in South Asia. Researchers from Symantec and the Carbon Black Threat Hunter Team said evidence from VirusTotal submissions and lure themes points to likely targeting in **India** and **Afghanistan**, with decoy documents referencing regional subjects such as **Zomato** and **Umrah**. The campaign delivers ELF payloads disguised as PDF files, using a dropper to display a lure document while covertly launching the backdoor. Once installed, the Linux malware uses **Microsoft Graph API** and Outlook mailboxes as a covert command-and-control channel, blending malicious traffic with legitimate cloud activity to evade perimeter monitoring. The backdoor relies on hardcoded Azure AD credentials, polls a designated Outlook folder for encrypted email tasking, executes commands through `/bin/bash`, exfiltrates results by email, and deletes messages to reduce forensic visibility. Researchers linked the Linux and Windows variants through nearly identical code, shared C2 logic, and even matching spelling mistakes in strings and function names, indicating both were likely developed by the same threat actor.
Jun 29, 2026
A previously unreported intrusion at a law firm used spear-phishing emails to lure victims into opening a Mega-hosted encrypted archive containing a malicious Windows shortcut disguised as case documents. The shortcut launched obfuscated PowerShell, reduced Microsoft Defender protections, and staged a fake Python environment for DLL sideloading, where a rogue `python311.dll` loaded through a legitimate `python.exe` decrypted and executed a Go-based loader framework dubbed **HollowFrame**. Blackpoint Cyber said HollowFrame supported multiple execution methods, anti-analysis checks, and persistence through mechanisms including scheduled tasks, WMI event subscriptions, and Startup-folder deployment before delivering the Rust-based **Matryoshka** malware family. Investigators observed both an HTTP command-and-control variant and a GitHub-backed variant that used the GitHub Contents API and a private repository for victim-specific tasking, reconnaissance, file transfer, and payload delivery, giving the attacker persistent remote command execution and Active Directory visibility that could enable credential theft, lateral movement, and wider domain compromise.
Aug 11, 2026