--- title: Researchers Uncover HOLLOWGRAPH: Malware That Hides... description: Group-IB has detailed HOLLOWGRAPH, a previously undocumented Windows malware implant that uses Microsoft 365 calendar events as a covert command-and-control... canonical: https://daily.dev/posts/researchers-uncover-hollowgraph-malware-that-hides-inside-microsoft-365-calendar-invites-soyoa6dwd twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Researchers Uncover HOLLOWGRAPH: Malware That Hides Inside Microsoft 365 Calendar Invites | daily.dev og:description: Group-IB has detailed HOLLOWGRAPH, a previously undocumented Windows malware implant that uses Microsoft 365 calendar events as a covert command-and-control... og:url: https://daily.dev/posts/researchers-uncover-hollowgraph-malware-that-hides-inside-microsoft-365-calendar-invites-soyoa6dwd og:image: https://api.daily.dev/og/posts/SOyOa6dWd.png og:image:alt: Researchers Uncover HOLLOWGRAPH: Malware That Hides Inside Microsoft 365 Calendar Invites og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Researchers Uncover HOLLOWGRAPH: Malware That Hides Inside Microsoft 365 Calendar Invites **[IT Security Guru](https://daily.dev/sources/itsecurityguru)** · 5 min read · 0 upvotes · 0 comments ## Summary Group-IB has detailed HOLLOWGRAPH, a previously undocumented Windows malware implant that uses Microsoft 365 calendar events as a covert command-and-control channel. Operators plant instructions by creating calendar events dated to May 2050, while the malware exfiltrates stolen data as encrypted attachments on those same events — all through legitimate Microsoft Graph API calls from a compromised mailbox, making traffic hard to distinguish from normal M365 usage. A secondary DNS tunneling channel over IPv6 AAAA queries refreshes attacker credentials. The malware is linked with high confidence to the Cavern backdoor framework and tentatively to the Iranian-nexus group Lyceum/OilRig. At least 12 systems were infected in what appears to be a narrow, targeted espionage operation focused on Israeli organizations. Defenders are advised to monitor Graph API and mailbox audit logs for anomalous calendar operations, watch for events dated 2050-05-13, restrict OAuth2 client credentials, and deploy DNS tunneling detection. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does the HOLLOWGRAPH malware use Microsoft 365 calendar invites for command and control? HOLLOWGRAPH abuses the Microsoft Graph API on a compromised Microsoft 365 mailbox, treating its calendar as a two-way dead drop. Attackers plant tasking instructions by creating calendar events referencing a task ID, while the malware exfiltrates stolen files by creating events with encrypted attachments named File{n}.txt, all dated 13 May 2050 to avoid drawing the mailbox owner's attention. _Security teams hunting cloud-based C2 techniques can follow research like this on daily.dev._ ### What domain and file artifacts should defenders look for to detect a HOLLOWGRAPH infection? Defenders should hunt for the domain cloudlanecdn[.]com used for DNS tunnelling and a configuration file disguised as logAzure.txt storing stolen Entra ID tenant IDs, client IDs, and secrets. Additional indicators include calendar events dated 2050-05-13, GUID-only or Boss{..}ID{..} subject lines, and File{n}.txt attachments created via Graph API rather than by a human user. _Teams building detection rules for Microsoft 365 threats can track indicators like these via daily.dev._ ### Which threat actor is linked to the HOLLOWGRAPH malware and the Cavern framework? Group-IB attributes HOLLOWGRAPH with high confidence to the Cavern backdoor framework, based on matching command syntax and a shared toggle debug logging self-command. With low confidence, Cavern's modular functionality is linked to a .NET backdoor used by Lyceum, a sub-cluster of the Iranian threat actor OilRig, in early 2025, though the exact group behind the campaign remains unconfirmed. _Analysts tracking Iranian-nexus threat clusters can follow attribution research through daily.dev._ ## Similar posts on daily.dev - [Exploiting Google Gemini to Abuse Calendar Invites Illustrates AI Threats](https://daily.dev/posts/exploiting-google-gemini-to-abuse-calendar-invites-illustrates-ai-threats-j6bbmlvcw) · Security Boulevard · 0 upvotes · 0 comments - [New GoGra malware for Linux uses Microsoft Graph API for comms](https://daily.dev/posts/new-gogra-malware-for-linux-uses-microsoft-graph-api-for-comms-vwc7uzrie) · BleepingComputer · 0 upvotes · 0 comments - [Unplug Gemini from email and calendars, says cybersecurity firm](https://daily.dev/posts/unplug-gemini-from-email-and-calendars-says-cybersecurity-firm-egl7ezanv) · CSO Online · 0 upvotes · 0 comments - [Microsoft 365 Copilot – Arbitrary Data Exfiltration Via Mermaid Diagrams – Adam Logue](https://daily.dev/posts/microsoft-365-copilot-arbitrary-data-exfiltration-via-mermaid-diagrams-adam-logue-lezwuj6pt) · Hacker News · 1 upvotes · 0 comments --- Tags: [#microsoft](https://daily.dev/tags/microsoft), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/researchers-uncover-hollowgraph-malware-that-hides-inside-microsoft-365-calendar-invites-soyoa6dwd) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Researchers Uncover HOLLOWGRAPH: Malware That Hides Inside Microsoft 365 Calendar Invites","url":"https://daily.dev/posts/researchers-uncover-hollowgraph-malware-that-hides-inside-microsoft-365-calendar-invites-soyoa6dwd","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/researchers-uncover-hollowgraph-malware-that-hides-inside-microsoft-365-calendar-invites-soyoa6dwd"},"datePublished":"2026-07-20T10:52:05.571Z","dateModified":"2026-09-14T08:16:23.794Z","description":"Group-IB has detailed HOLLOWGRAPH, a previously undocumented Windows malware implant that uses Microsoft 365 calendar events as a covert command-and-control...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c1e74af4c2cc0b81a85276b684af4ed3?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c1e74af4c2cc0b81a85276b684af4ed3?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"IT Security Guru","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"IT Security Guru","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/ae9fe7d07c814192b35f86ad698fb374","url":"https://daily.dev/sources/itsecurityguru"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/researchers-uncover-hollowgraph-malware-that-hides-inside-microsoft-365-calendar-invites-soyoa6dwd","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"microsoft,malware","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"IT Security Guru","item":"https://daily.dev/sources/itsecurityguru"},{"@type":"ListItem","position":3,"name":"Researchers Uncover HOLLOWGRAPH: Malware That Hides Inside Microsoft 365 Calendar Invites"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/researchers-uncover-hollowgraph-malware-that-hides-inside-microsoft-365-calendar-invites-soyoa6dwd#faq","mainEntity":[{"@type":"Question","name":"How does the HOLLOWGRAPH malware use Microsoft 365 calendar invites for command and control?","acceptedAnswer":{"@type":"Answer","text":"HOLLOWGRAPH abuses the Microsoft Graph API on a compromised Microsoft 365 mailbox, treating its calendar as a two-way dead drop. Attackers plant tasking instructions by creating calendar events referencing a task ID, while the malware exfiltrates stolen files by creating events with encrypted attachments named File{n}.txt, all dated 13 May 2050 to avoid drawing the mailbox owner's attention. Security teams hunting cloud-based C2 techniques can follow research like this on daily.dev."}},{"@type":"Question","name":"What domain and file artifacts should defenders look for to detect a HOLLOWGRAPH infection?","acceptedAnswer":{"@type":"Answer","text":"Defenders should hunt for the domain cloudlanecdn[.]com used for DNS tunnelling and a configuration file disguised as logAzure.txt storing stolen Entra ID tenant IDs, client IDs, and secrets. Additional indicators include calendar events dated 2050-05-13, GUID-only or Boss{..}ID{..} subject lines, and File{n}.txt attachments created via Graph API rather than by a human user. Teams building detection rules for Microsoft 365 threats can track indicators like these via daily.dev."}},{"@type":"Question","name":"Which threat actor is linked to the HOLLOWGRAPH malware and the Cavern framework?","acceptedAnswer":{"@type":"Answer","text":"Group-IB attributes HOLLOWGRAPH with high confidence to the Cavern backdoor framework, based on matching command syntax and a shared toggle debug logging self-command. With low confidence, Cavern's modular functionality is linked to a .NET backdoor used by Lyceum, a sub-cluster of the Iranian threat actor OilRig, in early 2025, though the exact group behind the campaign remains unconfirmed. Analysts tracking Iranian-nexus threat clusters can follow attribution research through daily.dev."}}]} ```