HollowGraph is an espionage implant that turns a compromised Microsoft 365 calendar into its command channel and its exfiltration route. Rather than calling out to an attacker-controlled server, it plants operator instructions and smuggles stolen files inside calendar events dated to the year 2050 — far enough into the future that the mailbox owner is unlikely to ever scroll down and see them. Group-IB, the firm that discovered and named the malware, found it running against a small set of targets, with victim traffic observed from 3 June to 9 July 2026. (Source: The Hacker News)

The implant is a .NET DLL that supports only two commands: get and send. To pull tasking, it queries the calendar for an event the operator has planted at 2050-05-13 and reads its instructions from an attached file. To exfiltrate, it reverses the process — it encrypts the stolen file, creates its own far-future event, and uploads the data as one or more attachments. Everything moving through the calendar is wrapped in hybrid RSA and AES-256 encryption, with separate key pairs for incoming tasking and outgoing data.

What makes this hard to catch is that none of it looks unusual on the network. The malware moves everything through legitimate Microsoft Graph API traffic, so the activity blends in with ordinary Microsoft 365 chatter.

Because there is no attacker-owned destination to block, network controls keyed to malicious domains have nothing to flag — the traffic goes to Microsoft's own cloud.

If your organization runs on Microsoft 365, that is precisely why this matters to you. There is no software vulnerability here and no patch to deploy. HollowGraph rides a compromised account and Graph's normal functionality, which means the exposure sits in identity, application permissions, and monitoring rather than in an unpatched server. An attacker with valid access can operate through the same trusted services your staff use every day.

Attack Chain and Technical Mechanics of HollowGraph

HollowGraph is a .NET DLL implant that carries just two commands — get and send — and never contacts an attacker-owned server for payloads. That minimalism is the point: with no payload-fetch callbacks, there is no beacon to a suspicious IP that a network filter can catch.

Group-IB ties the code to Cavern, a modular backdoor framework documented by Check Point earlier this month, based on shared command syntax and matching internal tasking. Check Point attributes Cavern to an Iranian Ministry of Intelligence and Security-linked cluster it calls Cavern Manticore, which overlaps with the known Iranian groups MuddyWater and Lyceum. Group-IB itself declines to name the HollowGraph operator, noting only a low-confidence overlap with Lyceum, a subgroup of OilRig.

"Based on the evidence currently available, we cannot confidently attribute this activity to any previously identified threat actor," Group-IB wrote.

The tasking mechanism works as a two-way dead drop inside the compromised mailbox. On a get, the implant queries the calendar for an event the operator has already planted and reads its instructions from an attached file. On a send, it reverses the flow: encrypts the stolen file, creates its own far-future event, and uploads the data as one or more attachments.

Everything moving through the calendar is wrapped in hybrid RSA and AES-256 encryption, using separate key pairs for incoming tasking and outgoing data. For a SOC analyst, that means even if you capture the Graph traffic, the event payloads are opaque without the operator's private keys — the abnormal metadata is what gives the activity away, not the contents.

Keeping Graph access alive over DNS

A second, cruder channel refreshes the implant's authentication. Over DNS, HollowGraph pulls updated Entra ID (Azure AD) login details — tenant ID, client ID, client secret, and target mailbox — by decoding values from IPv6 AAAA records returned by the attacker domain cloudlanecdn[.]com. It writes those values to logAzure.txt, a file made to look like a routine log.

These are stored client credentials, not access tokens, and unlike the encrypted calendar traffic this DNS channel runs in the clear. Business translation: an attacker who can rotate the app's credentials on the fly keeps mailbox access even if a single secret is revoked, because the implant simply reads the next one from a fresh AAAA record.

Indicators tied to the malware's own habits

The strongest signals live in the calendar objects the implant creates. According to Group-IB, hunt for events carrying:

• A far-future date, specifically 2050-05-13 — chosen so the mailbox owner never scrolls far enough to see it;
• A subject that is a bare GUID, or that matches the operator's Event ID: or Boss{..}ID{..} naming convention;
• Attachments named File{n}.txt;
• The config file logAzure.txt and outbound resolution of cloudlanecdn[.]com.

Group-IB found the implant on at least 12 machines, with only about three actively communicating during the analysis window and victim traffic running from 3 June to 9 July 2026. The compromised exfiltration mailbox belongs to an Israeli organization, which Group-IB treats as victim geography rather than an attribution signal. That small, selective footprint points to targeted espionage rather than opportunistic crime.

There is no Microsoft software vulnerability in this chain and no patch to apply. HollowGraph rides a compromised account and the Graph API's normal functionality — application-driven calendar changes that look like ordinary Microsoft 365 activity — which is why identity and application-permission controls, not endpoint patching, are where the exposure sits. The full indicator set, including file hashes, is published in Group-IB's report.

Threat Actors Behind HollowGraph: Cavern Manticore, Lyceum, MuddyWater, and OilRig

Group-IB's attribution rests on code overlap, not a confirmed operator. The firm ties HollowGraph to Cavern with high confidence based on shared command syntax and matching internal tasking, but it stops short of naming the crew running this specific campaign.

That caveat matters. For your threat intelligence team, it means treating HollowGraph as an Iranian-aligned tool that could be shared across clusters, not the fingerprint of a single group. The four actors named in the reporting sit at different distances from the actual campaign.

Cavern Manticore is the closest link on the technical side. Check Point documented the Cavern backdoor framework and attributed it to this cluster, which it assesses as linked to the Iranian Ministry of Intelligence and Security. Cavern is modular, meaning operators can swap components in and out — HollowGraph reads like one such component, an exfiltration module bolted onto an existing framework rather than a standalone tool built from scratch.

Check Point places Cavern Manticore in overlap with two long-running Iranian names:

• MuddyWater — a group with a documented history of espionage against government, telecom, and energy targets across the Middle East, using commodity remote-access tooling and living-off-the-land techniques to stay quiet inside networks.
• Lyceum — described here as a subgroup of the Iranian actor OilRig, itself one of the more established Iranian intrusion sets known for credential theft and long-dwell access against energy and telecommunications organizations.

Group-IB's own low-confidence pointer is toward Lyceum, which nests under OilRig. So the reporting gives you a chain of associations — Cavern Manticore overlapping MuddyWater and Lyceum, Lyceum sitting inside OilRig — rather than a single clean attribution. That is the honest state of the evidence, and it shapes how you should read the risk.

These groups share a common motivation: intelligence collection on behalf of Iranian state interests. Their targeting historically concentrates on Middle Eastern governments, defense, telecom, and energy sectors, with regional adversaries a recurring focus. The compromised exfiltration mailbox in this campaign belonged to an Israeli organization, which fits that geopolitical pattern — though Group-IB explicitly treats victim geography as a data point about the target, not proof of who built or ran the implant.

For a defender, the practical takeaway is about likelihood. If your organization operates in the Middle East, or in energy, telecom, defense, or government verticals, an Iranian-aligned espionage actor using a shared, modular framework is a credible threat to model against. The espionage motive means the goal is quiet, persistent access to your communications and documents — not disruption or extortion — so the damage shows up as long-term exposure of sensitive data rather than a single loud event.

Group-IB read the footprint of this campaign — the implant found on at least 12 machines, only about three actively communicating during the analysis window — as targeted espionage rather than opportunistic crime. The technique behind it, however, is portable across any of these clusters, which is why the tool and the crew are worth tracking separately.

Business and Operational Impact of HollowGraph Infections

The exfiltration mailbox in this campaign belonged to an Israeli organization, and Group-IB found HollowGraph on at least 12 machines, with only about three actively communicating with the operator during the analysis window. That small, selective footprint tells you something specific about your risk: this is targeted espionage, not a mass ransomware sweep, so the concern for your firm is not encrypted files but quiet, sustained data theft.

The stolen data moves as encrypted attachments named File{n}.txt on calendar events. The malware's get and send commands mean an operator can direct it to collect and remove any file the compromised account can reach.

For a targeted victim, that typically means the material an espionage actor wants: internal documents, correspondence, credentials, and intellectual property. If your organization holds regulated data — patient records under HIPAA, personal data under GDPR, or financial records under SOX — a HollowGraph infection touching those files creates a reportable event, not just a technical one.

What makes calendar-based command-and-control harder to catch than a conventional backdoor is that it produces no traffic to an attacker-owned address. Everything rides Microsoft Graph API calls to Microsoft 365 itself, wrapped in hybrid RSA and AES-256 encryption.

Your network filters keyed to suspicious destinations have nothing to flag, because the destination is Microsoft. Your email security gateway sees no malicious message, because the data never travels as email. The activity blends into ordinary Microsoft 365 chatter, which is exactly why an operator can stay resident on a mailbox for weeks.

The dwell time matters for your breach-notification obligations. Group-IB observed victim traffic running from 3 June to 9 July 2026 in this campaign, and the technique is built to extend that window. Under GDPR, you have a 72-hour notification clock that starts when you become aware of a breach — but you cannot start a clock you never hear ring, and undetected exfiltration means the data is already gone before any obligation is triggered.

There is a second consequence worth weighing: the DNS side channel that refreshes the app's stored Entra ID client credentials — tenant ID, client ID, client secret, and target mailbox — runs in the clear over IPv6 AAAA records. Those are application credentials, not user tokens, which means the access does not break when a user changes a password.

For your identity team, that changes the containment math. Rotating a compromised user's password does nothing here; the operator retains Graph access through the application registration until you find and revoke the client secret. An OAuth application with mailbox and calendar permissions can reach data across every account those permissions cover, so the exposure is not limited to a single inbox.

The reputational and compliance costs follow the sensitivity of what was taken. If the exfiltrated files include client data, contract terms, or research your organization is contractually or legally bound to protect, a confirmed compromise obliges you to notify affected parties and regulators, and the disclosure itself can affect customer trust and contractual standing.

Because there is no software vulnerability behind HollowGraph and no patch to deploy, you cannot buy down this risk by updating a version. The exposure lives in your identity configuration and application permissions, and it persists until you audit which apps can reach Graph and what data they touch.

The practical takeaway for decision-makers: treat any organization holding high-value intellectual property or regulated data as a plausible target, because the same technique that hit one Israeli victim can be reused against any Microsoft 365 tenant. Victim traffic was flowing as recently as 9 July 2026, so this is an active, not historical, concern.

Detection and Immediate Response Actions for HollowGraph

The single most important action is to hunt your Microsoft 365 audit logs for calendar events dated 2050-05-13. Because HollowGraph plants both its tasking and its stolen data on events at that exact far-future date, a search for that timestamp is the fastest way to confirm whether this implant has touched your tenant.

Following the NIST Cybersecurity Framework, here is the order of work — from what to inventory today through recovery.

Identify. List every OAuth application in your Entra ID tenant that holds client-credential permissions to Microsoft Graph, especially those with Calendars.ReadWrite and mailbox access. HollowGraph relies on a registered app with a valid client secret rather than a user token, so an unrecognized or over-permissioned app is where your investigation starts. Confirm which mailboxes those apps can reach.

Protect. Rotate credentials on any suspect app registration and revoke stale client secrets immediately. Restrict which apps may call Graph, enforce Conditional Access on application sign-ins, and alert on newly created client secrets — the malware refreshes its own stored credentials, so a fresh secret you did not create is a strong signal.

Detect. Query mailbox and Graph activity for application-driven calendar changes rather than human ones. Focus on:

• Calendar events created, renamed, or given attachments by an app identity instead of a person.
• Event subjects that are a bare GUID, or that follow the operator's Event ID: or Boss{..}ID{..} naming pattern.
• Attachments named File{n}.txt on those events.
• DNS traffic showing unusually frequent AAAA (IPv6) queries and long, high-entropy subdomains aimed at a single domain — the channel HollowGraph uses to decode its Entra ID login details in the clear.

Hunting for the domain cloudlanecdn[.]com and the config file logAzure.txt is the fast first pass on your endpoints and DNS logs. Group-IB's full indicator set, including file hashes, supports a broader sweep once the quick check is done.

Because the DNS channel runs unencrypted, your resolver logs are the one place this activity is plainly visible. In environments Capstone manages, Adlumin monitors authentication and application sign-in patterns across managed environments, flagging the anomalous Graph app behavior and new client secrets that indicate a hijacked OAuth app before data leaves the mailbox.

Respond. On any confirmed hit, treat the app registration as the entry point: disable it, then reset credentials for the affected mailbox and any account that authorized it. Pull the calendar attachments before you delete the events — the File{n}.txt payloads and the far-future tasking event are your evidence of what was collected and sent. Review Graph and mailbox access logs to reconstruct which files the operator directed the implant to exfiltrate, since the malware's two commands let it collect any file on a reachable host.

Recover. Once the app and credentials are clean, establish standing detection so the technique cannot be reused quietly. Build a persistent alert for calendar events with dates far outside a normal business window, restrict calendar-sharing and app-consent policies so users cannot grant Graph permissions to unvetted apps, and add credential rotation and anomalous-token detection to routine Entra ID hygiene. There is no patch here — no Microsoft vulnerability is involved — so the durable fix is tighter application permissions and monitoring of app-driven mailbox activity.

Victim traffic was flowing as recently as 9 July 2026, which makes the 2050 calendar search worth running against your tenant before anything else.

Prevention and Hardening: Reducing HollowGraph Attack Surface

Start with MFA on every Microsoft 365 account, without exception. HollowGraph rides a compromised account and legitimate Microsoft Graph API traffic, so the entry point is a stolen or phished credential rather than a software flaw. Enforcing multifactor authentication on all mailboxes — including service and shared accounts, which teams routinely skip — closes the most common path to the initial account takeover this campaign depends on.

Because this implant abuses features you cannot simply switch off, hardening means tightening how those features are reached and who can use them. Work through the areas below in the order of the NIST functions, from what you inventory to what you monitor.

Identify and Protect. Map your third-party and internally registered applications against what they can actually reach. HollowGraph maintains its access through stored client credentials, not user tokens, so the risk sits in the app registration layer that most account reviews never touch.

• Restrict which OAuth applications can request client-credential (application-permission) grants to Graph, and require admin consent for any new registration rather than allowing users to consent on their own.
• Apply Conditional Access policies that block sign-ins from unfamiliar locations, unmanaged devices, and legacy authentication protocols, and that flag or block token requests showing impossible-travel patterns.
• Set client-secret lifetimes short and rotate them on a schedule. A secret that never expires is a persistent key for an attacker who has already read your app configuration.
• Disable external calendar sharing by default in Exchange Online, and turn it on only for the specific mailboxes that genuinely need it. Narrowing calendar reach limits where a hijacked mailbox can be used as a two-way drop.
• Review Teams and Exchange Online app permission policies so that only vetted applications can create or modify calendar events programmatically.

Detect. The catch with legitimate-feature abuse is that ordinary controls have nothing to alert on. That is why identity monitoring, not perimeter filtering, is where you will see this activity.

The work is on identity and application permissions plus monitoring, not a patch.

Enable audit log retention of at least 90 days across your Microsoft 365 tenant so investigators have enough history to trace application-driven calendar changes back to their source. Shorter retention windows often expire before a quiet, sustained espionage campaign is ever noticed.

Adlumin monitors authentication and OAuth grant behavior across managed environments, surfacing newly created client secrets and application-driven mailbox activity that a person did not initiate — the exact signals this campaign generates. Pairing that identity telemetry with tenant audit logs gives you a way to see the application layer that HollowGraph hides inside.

Recover and reassess. Run periodic security assessments of your Microsoft 365 configuration, not just your endpoints. Treat app registrations, consent grants, calendar-sharing defaults, and Conditional Access rules as items that drift over time and need scheduled review.

The balance to hold is real: calendar sharing, the Graph API, and third-party app access all exist because businesses use them daily. The goal is not to remove those features but to grant them narrowly, log them fully, and confirm regularly that the permissions in place still match what each application actually needs.

Key Takeaway: Prioritize Microsoft 365 Audit Log Monitoring and Calendar Event Forensics

The lesson from HollowGraph is that command-and-control does not always announce itself with a beacon to a suspicious IP address. This implant carries its tasking and its stolen data inside ordinary Microsoft Graph API traffic, so the calendar becomes both the mailbox and the dead drop. Your network filters have nothing to flag because there is no attacker-owned destination in the flow.

That shifts where the useful evidence lives. The abuse happens inside your Microsoft 365 tenant, in the application-driven changes to calendar events — creations, attachment uploads, and subject renames performed by an app rather than a person. Standard email monitoring does not surface this, because nothing suspicious is passing through the mail flow you already watch.

Calendar-based C2 is a vector many organizations have simply never considered. Attackers have run this trick through inboxes, draft folders, and cloud storage before; parking events far in the future is the current variation, chosen precisely because no one scrolls out to a date decades away. The detection gap is not a missing tool but an unexamined data source.

The single most useful step is to examine your current Microsoft 365 calendar activity for the marks HollowGraph leaves behind: events created or modified by an application identity rather than a user, and anomalous far-future timestamps that no legitimate meeting would carry. If your tenant has been touched, the record is sitting in your audit logs waiting to be read.