Microsoft 365 is no longer just a productivity platform. For modern threat actors, it is also trusted infrastructure that can hide command-and-control, credential refresh, and data movement in traffic defenders are conditioned to allow.

Group-IB published new research on HOLLOWGRAPH, a Windows malware component the company links with high confidence to the Cavern backdoor framework. The reporting describes a narrowly targeted espionage operation that abused a compromised Microsoft 365 mailbox calendar as a covert two-way dead drop. Operators could place tasking in calendar events, while the implant could return encrypted stolen data as calendar attachments.

That matters for small businesses and government contractors because the technique does not rely on a weird command server lighting up a firewall dashboard. It blends into the exact cloud services many organizations depend on every day: Microsoft Graph API, Entra ID application credentials, Exchange Online mailboxes, and DNS.

What Group-IB Found

According to Group-IB, HOLLOWGRAPH uses Microsoft Graph API access to interact with a compromised Microsoft 365 calendar. The implant supports two core operations: retrieving attacker instructions and sending data back. Instead of using a conventional C2 server for that exchange, it stores tasking and output in calendar events scheduled far in the future.

The malware also uses DNS tunneling to refresh Microsoft Entra ID credentials. Group-IB reported the attacker-controlled domain cloudlanecdn[.]com and described IPv6 AAAA record queries carrying chunks of updated configuration data. The Graph-based communications are encrypted with a hybrid RSA and AES-256-GCM scheme, which means defenders should not expect the content itself to be readable even when the transport is visible.

Group-IB identified at least 12 infected systems, with only a smaller subset actively communicating with attacker infrastructure during the observed period. The victimology pointed toward Israeli entities, and Group-IB noted technical overlaps with Iranian-nexus activity, while stopping short of a firm actor attribution.

Why This Is Bigger Than One Malware Family

The key lesson is not just “block one domain” or “add three hashes.” HOLLOWGRAPH is another example of adversaries moving deeper into trusted cloud control planes. If your detection program treats Microsoft 365 activity as mostly benign by default, an attacker can use that trust against you.

For SMBs and contractors, this is especially uncomfortable. Microsoft 365 is often the identity provider, email system, document store, collaboration layer, and audit source all at once. A compromised OAuth application or mailbox can become a bridge across multiple parts of the business without needing loud malware traffic at the perimeter.

Defensive Checks Worth Doing Now

  • Review Graph API application permissions. Look for app registrations with mail, calendar, file, or offline access that do not have a clear business owner.
  • Audit client secrets and service principals. Alert on new client secrets, unusual credential rotation, and service principals accessing mailboxes they do not normally touch.
  • Hunt for strange calendar artifacts. Prioritize events created by applications rather than users, events scheduled years into the future, attachment uploads to calendar events, GUID-like subjects, or repeated subject modifications.
  • Turn on and retain the right Microsoft 365 logs. Unified Audit Log, Entra ID sign-in logs, audit events for service principals, Exchange mailbox audit, and Graph activity visibility are all useful here.
  • Watch DNS for tunneling patterns. Long, high-entropy subdomains and frequent AAAA queries to rarely seen domains deserve attention, especially from endpoints that also show suspicious Microsoft 365 activity.
  • Apply Conditional Access to non-human identities where possible. Service principals and workload identities need governance too, not just user MFA policies.

What Bulwark Black Would Prioritize

If you only have time for a focused hunt, start with Microsoft 365 and Entra ID rather than endpoint hashes. Pull calendar event creation and attachment activity performed through applications, then cross-reference the initiating app, mailbox, source IP, and DNS behavior from the same host. You are looking for a chain: cloud app authentication, mailbox/calendar operations, unusual event metadata, and DNS lookups that do not fit the endpoint’s normal role.

For government contractors, this also ties directly into basic cyber hygiene expectations: inventory privileged access, monitor external services, protect authentication mechanisms, and preserve logs long enough to investigate. A small tenant with clean logging and disciplined app governance is much harder to abuse than a larger tenant full of forgotten OAuth grants and unmanaged service accounts.

Bottom Line

HOLLOWGRAPH is a useful warning shot. Attackers are not only hiding behind residential proxies or compromised routers; they are using trusted SaaS workflows as operational infrastructure. Defenders need to treat cloud audit trails, service principal behavior, mailbox operations, and DNS telemetry as one connected detection surface.

Original research: Group-IB: HOLLOWGRAPH: Turning Microsoft 365 Calendars into Covert Command-and-Control Channels

Feedly source item: CySecurity News summary