Malware Finds a New Hideout: Your Work Calendar
A newly discovered strain of malware is doing something that sounds almost too clever to be real: it uses a compromised Microsoft 365 calendar as its command-and-control (C&C) channel. Researchers at Group-IB have named it HollowGraph, and its trick is both elegant and deeply unsettling for any organization that lives inside the Microsoft ecosystem.
The malware doesn’t phone home to some shady server in a far-off data center. Instead, it talks to its operators by reading and writing calendar events on a legitimate business account. The whole thing runs through the Microsoft Graph API, making the malicious traffic look like ordinary Office 365 sync activity.
How HollowGraph Turns a Calendar Into a Dead-Drop
The technique is straightforward in concept but vicious in execution. HollowGraph takes over a victim’s mailbox — in this case, one belonging to an Israeli organization — and uses its calendar as a two-way drop box. Attackers plant new instructions by creating calendar events. The malware, in turn, exfiltrates stolen files by creating its own events with encrypted payloads attached.
These events are dated far in the future — specifically, May 13, 2050. The logic is simple: a calendar event three decades away won’t show up on anyone’s daily agenda. It sits quietly in the background, invisible to the legitimate user, while the malware reads and writes data at will. Payloads are encrypted using a hybrid RSA + AES scheme, so even if someone stumbles onto the event, they can’t read its contents.
HollowGraph supports just two commands: ‘send’ and ‘get’. The ‘send’ command creates a new appointment with an attached file for exfiltration. The ‘get’ command searches for appointments planted by the operator and downloads new instructions. It’s a minimal, purpose-built system — and that’s exactly what makes it hard to spot.
Secondary Channel and Configuration Details
Group-IB found that HollowGraph doesn’t rely solely on the calendar trick. It maintains a secondary communication channel using DNS tunneling to refresh its configuration and update the Microsoft Entra ID (formerly Azure AD) credentials used for authentication. This fallback ensures the malware can still operate even if the primary calendar channel is disrupted.
Upon execution, HollowGraph writes its hardcoded configuration to disk as a file named logAzure.txt. That configuration includes the Entra ID tenant ID, a client ID and secret, the target mailbox address, the C&C domain, and two RSA keys. It’s a complete operational package — the malware never needs to reach out to an attacker-controlled server for initial payload delivery.
Victim Profile: A Focused Campaign, Not a Spray-and-Pray
The evidence points to a narrow, deliberate targeting. Group-IB identified 12 victims, three of which were actively communicating with attacker infrastructure at the time of discovery. The earliest observed communication dates to June 3, suggesting the malware has been operational for roughly six weeks.
Key indicators — including the compromised Israeli mailbox used for exfiltration and malware samples uploaded from Israel — suggest the attackers are laser-focused on Israeli entities. This isn’t a broad, opportunistic campaign. It’s a surgical operation aimed at specific targets.
Attribution: Likely Iran-Nexus, But With Low Confidence
Attribution is always a messy business, and HollowGraph is no exception. Group-IB believes the malware is part of a variant of the Cavern framework, which Check Point detailed earlier this month under the name Cavern Manticore. That framework is linked to an Iran-nexus threat actor.
However, Group-IB is careful to note that it attributes HollowGraph to the Lyceum subgroup (also known as Hexane and SiameseKitten) with low confidence. Lyceum is itself a subgroup of the broader OilRig cluster, which is tied to Iran’s Ministry of Intelligence and Security (MOIS). The researchers found technical similarities — command format, structural patterns — but nothing unique enough for a high-confidence link.
“Based on the evidence currently available, we cannot confidently attribute this activity to any previously identified threat actor,” Group-IB notes in its report. “While these overlaps are noteworthy, they are not sufficiently unique to support a high-confidence attribution.”
What This Means for Defenders
The HollowGraph technique is a reminder that attackers are constantly looking for legitimate services to hide in. Microsoft 365 is so deeply embedded in enterprise workflows that security teams rarely scrutinize calendar API traffic. That’s exactly the blind spot HollowGraph exploits.
For defenders, the key takeaway is to monitor API activity — not just email and file transfers. Anomalous calendar event creation, especially events dated far in the future with unexpected file attachments, should raise red flags. Organizations using Microsoft 365 should also review which applications and service principals have Graph API permissions and audit for any that don’t match known, approved tools.
The days of looking only at network traffic for C&C are long gone. When malware can hide inside your own calendar, the perimeter has moved — and it’s sitting right there in your Outlook folder.
