HollowGraph Malware Hijacks 365 Calendars

A sophisticated new Windows malware, dubbed HollowGraph, has been discovered using a novel method for stealthy communication. By abusing the Microsoft Graph API, the malware transforms standard Microsoft 365 calendar appointments into a two-way command and control (C2) channel, allowing attackers to transmit instructions and exfiltrate data without triggering traditional network alerts.

Targeting Israeli Entities

Researchers at Group-IB have identified that this campaign appears to be highly localized. Analysis indicates that the compromised mailboxes and associated infrastructure for the Cavern backdoor framework are primarily linked to Israeli organizations. While the researchers could not definitively tie the activity to a single known threat actor, they noted technical overlaps with the Iranian-nexus group Lyceum.

The relatively small number of identified victims suggests that the operation is highly targeted rather than opportunistic.

— The researchers at Group-IB, as said in a July 20 post

Mechanics of the Calendar C2

The malware architecture avoids direct communication with attacker-controlled servers, relying instead on trusted third-party infrastructure. It supports two primary commands: get and send. The send function generates calendar appointments that contain encrypted, stolen files as attachments, while the get function monitors for appointments created by the operator to retrieve instructions.

To maintain access to the Microsoft Graph channel, the malware utilizes DNS tunneling for the refresh of Microsoft Entra ID credentials. The security of the data within these calendar events relies on a hybrid encryption scheme, combining RSA with AES-256-GCM to secure the inbound and outbound traffic.

Connection to Cavern Framework

Technical analysis suggests that HollowGraph is a variant of the broader Cavern framework. The malware employs a specific command syntax format, _;;__,__,_, which matches the established structure observed in Cavern toolkit components. Further indicators include matching debug logging instructions and identical C2 tasking formats.

• 12: Total number of systems identified as infected with HollowGraph.
• June 3, 2026: Date of the earliest observed communication between a victim and the attacker.
• July 9, 2026: Date of the most recent identification of the malware.

Consequences for Enterprise Security

The emergence of HollowGraph represents a shift toward using legitimate enterprise cloud services to bypass perimeter defenses. Because the malware operates through Microsoft 365 audit trails and API calls, standard network monitoring may fail to detect the exfiltration. Security teams may need to prioritize auditing anomalous calendar operations—such as automated event creation or unusual attachment uploads—to identify potential compromises within their environments.