How HollowGraph Uses Microsoft 365 Calendars for Covert C2

Researchers from Group-IB have discovered a spyware implant called HollowGraph that uses the calendar of a compromised Microsoft 365 account as a bidirectional command-and-control channel. Operator commands and exfiltrated files are transmitted as attachments to calendar events dated in the year 2050 via the legitimate Microsoft Graph API. The implant was found on at least 12 machines, with active victim traffic observed from 3 June to 9 July 2026. There is no vulnerability in Microsoft products involved here — the attack abuses standard API functionality and compromised credentials, which makes identity controls and OAuth application monitoring the main defensive priorities.

How it works: calendar as a dead drop

According to the researchers, HollowGraph is a .NET DLL library with a minimalist set of just two commands — get and send. The implant does not contact attacker-controlled servers to fetch payloads. Instead, the compromised mailbox is turned into a “dead drop” with two-way communication.

To receive tasks, the implant queries the calendar for an event created by the operator with the date 2050-05-13 — far enough in the future that the mailbox owner would never see it during normal use. Instructions are read from the attached file. The exfiltration process is mirrored: the stolen file is encrypted, a new event is created far in the future, and the data is uploaded as one or more attachments.

All traffic through the calendar is protected with hybrid RSA + AES-256 encryption, using separate key pairs for incoming tasks and outgoing data. From a network monitoring perspective, the activity looks like normal interaction with Microsoft 365 via Graph API, and security controls tuned to detect connections to suspicious external servers do not flag anything.

Auxiliary channel over DNS

To maintain access to Graph API, the implant uses a second, less sophisticated channel. Via DNS queries to the domain cloudlanecdn[.]com, HollowGraph updates the application credentials in Entra ID (Azure AD): tenant ID, client ID, client secret, and the target mailbox. These values are decoded from IPv6 AAAA records returned by the attackers’ DNS server and written to a file named logAzure.txt, masquerading as an ordinary log. As the researchers note, what is transmitted are client credentials rather than access tokens, and unlike the calendar channel, this exchange is not encrypted.

Attribution: code identified, operator unknown

Group-IB links HollowGraph with high confidence to the Cavern codebase based on matching command syntax and internal task structures. Cavern is a modular remote management framework that earlier this month was documented by Check Point, which attributed it to the Cavern Manticore group, allegedly connected to Iran’s Ministry of Intelligence and Security and overlapping with known Iranian groups MuddyWater and Lyceum.

However, the link is to the code rather than to a specific operator. Group-IB explicitly states that based on the available data, the company cannot confidently attribute this activity to any previously identified actor. The compromised mailbox used for exfiltration is said to belong to an Israeli organization, but the researchers treat this as victim geography rather than a basis for attribution.

Scale and nature of the campaign

According to Group-IB, the implant was found on at least 12 machines, of which only around three communicated actively with the attacker during the observation period. The researchers interpret this small, selective footprint as a sign of targeted espionage rather than opportunistic cybercrime. At the same time, the technique itself is potentially applicable far beyond this particular campaign.

Crucially, there is no vulnerability in Microsoft software here and no patch that can be applied. HollowGraph relies on a compromised account and standard Graph API functionality. That is precisely why the implant is difficult to detect with conventional network security tools.

Detection and protection recommendations

Hunting for artifacts in the calendar

The most distinctive signs of compromise are found directly in the calendar. Look for events with the following characteristics:

• A date far in the future, in particular 2050-05-13
• The event subject is a bare GUID, or matches patterns like Event ID: or Boss{..}ID{..}
• Attachments named in the style of File{n}.txt

Identity and OAuth application control

• Restrict and audit OAuth applications using client credentials that have access to Microsoft Graph
• Configure alerts for the creation of new client secrets in Entra ID
• Enforce conditional access policies, regular credential rotation, and anomalous token detection

Monitoring Graph API and DNS activity

• Track calendar changes performed by applications rather than users: event creation, attachment uploads, subject renaming
• Log abnormally frequent AAAA DNS queries and long, high-entropy subdomains targeting a single domain
• Check for any requests to the domain cloudlanecdn[.]com and the presence of the file logAzure.txt on endpoints — this is the fastest primary indicator

The full set of indicators of compromise, including file hashes, is available in the Group-IB report.

Abusing trusted Microsoft cloud services for covert command and control is not a new trick: attackers have previously used Outlook inbox folders, drafts, and OneDrive for this purpose. Calendar events in the year 2050 are simply another spot that defenders have so far had no reason to inspect. Given that victim traffic was still observed on 9 July and the campaign operator has not yet been identified, organizations using Microsoft 365 should immediately check their calendars for events far in the future and audit OAuth applications with access to Graph API.