HOLLOWGRAPH: .NET NativeAOT Malware Abusing Microsoft Graph API and M365 Calendar Events for C2, Linked to Cavern Manticore/Lyceum (Low Confidence)

HOLLOWGRAPH: .NET NativeAOT Malware Abusing Microsoft Graph (TL-2026-1553), also tracked as HOLLOWGRAPH, is a high-severity malware campaign, first published 2026-07-20 and last reviewed 2026-07-21. It is attributed to Cavern Manticore (Iran) with low confidence, affects Microsoft Microsoft 365 / Microsoft Graph API, maps to 74 MITRE ATT&CK techniques (T1005, T1008, T1010), and is covered by 9 detection rules and 42 indicators of compromise.

Key facts for TL-2026-1553

Threat ID
TL-2026-1553
Also known as
HOLLOWGRAPH, Cavern, Cav3rn, Cavern Manticore
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-07-20
Last reviewed
2026-07-21
Attribution
Cavern Manticore
Attribution confidence
LOW
Nation-state nexus
Iran
Motivation
ESPIONAGE
Target sectors
government administration, itservices, telecoms, oilgas, aviation, internetserviceproviders
Target regions
israel, Middle East
Detection rules
9
Indicators of compromise
42
Updates
2026-07-21 · revalidated 1× · latest source

Malware and tooling in HOLLOWGRAPH: .NET NativeAOT Malware Abusing Microsoft Graph

Malware and tooling: Cavern Manticore, HOLLOWGRAPH, SysAid

Group-IB identified HOLLOWGRAPH, a Windows .NET NativeAOT-compiled DLL that abuses the Microsoft Graph API to exfiltrate files and receive attacker commands via Microsoft 365 calendar events dated to year 2050, with IPv6 DNS tunneling to cloudlanecdn[.]com used to refresh Entra ID credentials. Twelve infected systems were identified (3 actively communicating) at Israeli entities during a June 3 - July 9, 2026 observation window, with low-confidence links to the Cavern backdoor framework and the Iranian MOIS-nexus actor Lyceum, a suspected OilRig sub-group tracked by Check Point as 'Cavern Manticore.'

How HOLLOWGRAPH: .NET NativeAOT Malware Abusing Microsoft Graph works

HOLLOWGRAPH is a Windows DLL malware component compiled with .NET NativeAOT, part of a modular toolset that Group-IB assesses shares command-format and plugin-loading overlaps with the Cavern backdoor framework independently profiled by Check Point Research as 'Cavern Manticore' (also tracked historically as 'Cav3rn'). The malware turns a compromised Microsoft 365 mailbox/calendar into a bidirectional dead-drop C2 channel: operators create calendar events dated far in the future (2050-05-13) with subjects encoding a 7-character task ID (e.g. 'Event ID: <taskID>'); the implant polls the Microsoft Graph API for these events, downloads encrypted attachments named File{n}.txt, and decrypts them with an embedded RSA-2048 private key using RSA-OAEP-SHA256 to unwrap an AES-256-GCM session key. To exfiltrate data, the implant encrypts target files with a separate RSA-2048 public key, uploads the ciphertext as File{n}.txt attachments to newly created 2050-dated calendar events, and renames the event subject to a 'Boss{..}ID{..}' format for operator triage. A secondary channel uses DNS tunneling over IPv6 AAAA queries to cloudlanecdn[.]com (via the DnsClient.NET library) to refresh Microsoft Entra ID OAuth2 client-credential parameters (tenantId, clientId, clientSecret, target mailbox) when the primary Graph API token expires, encoding roughly 14 usable bytes per IPv6 response reassembled into UTF-8 data. Configuration (hardcoded Entra ID app registration client ID/secret/tenant ID, target mailbox, and both RSA key pairs) is persisted on disk disguised as a benign log file, logAzure.txt. The technique of using separate RSA key pairs for inbound versus outbound traffic prevents cryptographic correlation of the two data flows, and calendar events dated decades in the future keep the C2 artifacts out of normal calendar UI views. Group-IB assesses the campaign as narrowly and deliberately targeted -- 12 total infected Israeli hosts with only 3 actively communicating during the observation window -- consistent with a disciplined, low-noise espionage operation rather than opportunistic malware distribution. Command-format analysis (underscore-delimited '<command>_;;_<arg0>_,_<arg1>_,_<arg2>' structure, base64-encoded numeric self-commands such as '003' for debug-logging toggle) closely mirrors the Cavern backdoor framework, and Group-IB notes technical overlap with a Lyceum .NET backdoor observed in early 2025 (SHA-256 315bdba98c6fe863d39f6afccc727e17d5aea63bf21259444fa988cae56d61c1) and an earlier Lyceum sample referenced in prior state-sponsored-actor reporting (SHA-256 1573e125197ec77d8e9930c611ba2802ee59e19629396b5e99b426b46c53bd25), but explicitly states it 'cannot confidently attribute this activity to any previously identified threat actor.' Independently, Check Point Research's Cavern Manticore report (published 2026-07-06) documents the same broader framework operating against Israeli IT providers and government targets via multi-hop supply-chain compromise -- moving from an initially compromised IT service provider through a second-hop provider before reaching the intended victim, abusing RMM tooling (e.g. SysAid's legitimate software-deployment feature, with Check Point explicitly stating no SysAid vulnerability was involved) for lateral distribution of malicious 'updates.' The Cavern Manticore toolset spans multiple compilation formats (.NET Framework IL-only, Mixed-Mode C++/CLI, and .NET 8 NativeAOT) used deliberately as an anti-analysis layer to force reverse engineers across differing toolchains, and includes DLL-sideloaded agent (uxtheme.dll), communications (n-HTCommp.dll), file-manager (mhm.dll), SQL browser (db.dll), LDAP/AD-recon (ode.dll), network-recon (n-ten.dll), and SOCKS5/WebSocket tunnel (n-sws.dll) modules sideloaded via a trojanized WinDirStat.exe deployment. Check Point attributes Cavern Manticore to Iran's Ministry of Intelligence and Security (MOIS) with overlap to Lyceum (OilRig sub-group) and MuddyWater tradecraft, citing a PDB path referencing developer alias 'rick,' WHOIS registration of hospitalinstallation[.]com through Iranian hosting provider Fars Data, and OilRig/Lyceum-consistent XOR obfuscation, Base64 encoding, and webshell-style ASP.NET handlers (cac.aspx).

MITRE ATT&CK techniques used in TL-2026-1553

Collection

T1005 Data from Local System; T1025 Data from Removable Media; T1039 Data from Network Shared Drive; T1074 Data Staged; T1113 Screen Capture; T1114.002 Email Collection: Remote Email Collection; T1119 Automated Collection; T1213 Data from Information Repositories

Command and Control

T1008 Fallback Channels; T1071.001 Application Layer Protocol: Web Protocols; T1071.004 Application Layer Protocol: DNS; T1090 Proxy; T1090.001 Proxy: Internal Proxy; T1090.002 Proxy: External Proxy; T1090.003 Proxy: Multi-hop Proxy; T1090.004 Proxy: Domain Fronting; T1102 Web Service; T1105 Ingress Tool Transfer; T1219 Remote Access Tools; T1571 Non-Standard Port; T1572 Protocol Tunneling

Discovery

T1010 Application Window Discovery; T1018 Remote System Discovery; T1046 Network Service Discovery; T1083 File and Directory Discovery; T1087 Account Discovery; T1087.002 Account Discovery: Domain Account; T1087.004 Cloud Account; T1135 Network Share Discovery; T1217 Browser Information Discovery; T1482 Domain Trust Discovery; T1526 Cloud Service Discovery; T1538 Cloud Service Dashboard; T1580 Cloud Infrastructure Discovery

Exfiltration

T1020 Automated Exfiltration; T1041 Exfiltration Over C2 Channel; T1537 Transfer Data to Cloud Account; T1567 Exfiltration Over Web Service

Lateral Movement

T1021 Remote Services; T1021.001 Remote Desktop Protocol; T1021.002 Remote Services: SMB/Windows Admin Shares; T1021.003 Remote Services: Distributed Component Object Model; T1021.005 VNC; T1021.006 Remote Services: Windows Remote Management; T1550 Use Alternate Authentication Material; T1570 Lateral Tool Transfer

Defense Evasion

T1027 Obfuscated Files or Information; T1036.003 Rename Legitimate Utilities; T1055 Process Injection; T1070.004 Indicator Removal: File Deletion; T1140 Deobfuscate/Decode Files or Information; T1218.009 System Binary Proxy Execution: Regsvcs/Regasm; T1574.001 DLL

Execution

T1047 Windows Management Instrumentation; T1059 Command and Scripting Interpreter; T1106 Native API; T1204.002 User Execution: Malicious File

Initial Access

T1078 Valid Accounts; T1195 Supply Chain Compromise; T1195.002 Compromise Software Supply Chain; T1199 Trusted Relationship; T1566.002 Spearphishing Link

Persistence

T1078.004 Valid Accounts: Cloud Accounts; T1133 External Remote Services; T1547 Boot or Logon Autostart Execution

Credential Access

T1110.004 Brute Force: Credential Stuffing; T1552.001 Unsecured Credentials: Credentials In Files; T1557 Adversary-in-the-Middle

lateral-movement

T1550.001 Use Alternate Authentication Material: Application Access Token; T1550.002 Use Alternate Authentication Material: Pass the Hash; T1550.003 Use Alternate Authentication Material: Pass the Ticket; T1550.004 Use Alternate Authentication Material: Web Session Cookie

Resource Development

T1584 Compromise Infrastructure; T1587.001 Develop Capabilities: Malware

Affected products and versions in HOLLOWGRAPH: .NET NativeAOT Malware Abusing Microsoft Graph

  • Microsoft — Microsoft 365 / Microsoft Graph API
    Vulnerable versions: cloud service - no version applicable
    Fixed in: not applicable - credential/token abuse, not a vulnerability
  • Microsoft — Windows (DLL host OS)
    Vulnerable versions: Windows endpoints running the HOLLOWGRAPH / Cavern DLL loader chain
    Fixed in: not applicable - malware, not a CVE-based vulnerability
  • SysAid — SysAid RMM (abused feature, not a vulnerability)
    Vulnerable versions: N/A - Check Point explicitly states no SysAid vulnerability was involved

Remediation for HOLLOWGRAPH: .NET NativeAOT Malware Abusing Microsoft Graph

Immediate actions

  • Hunt for on-disk artifact logAzure.txt (HOLLOWGRAPH config disguised as a log file) and config.txt / Cvn.cfg.A / Cvn.cfg.U (Cavern framework configs) across endpoints
  • Block DNS resolution to cloudlanecdn[.]com, hospitalinstallation[.]com and subdomains, adserviceupdate[.]com, and hygienehistory[.]com at the resolver/firewall
  • Search SHA-256 hashes in this record across EDR telemetry and VirusTotal retro-hunt (note: Cavern Manticore samples scored zero or very low AV detection)
  • Enumerate Entra ID app registrations with client-credentials OAuth2 grants and recently rotated client secrets for anomalous Graph API calendar/mailbox scopes
  • Alert on Microsoft Graph API calls creating or modifying calendar events dated far in the future (e.g. year 2050) or with subjects matching 'Event ID:' or 'Boss{..}ID{..}' patterns
  • Review RMM/software-deployment tooling (e.g. SysAid) audit logs at managed IT service providers for unauthorized package pushes to downstream client tenants

Workarounds

  • Restrict or monitor calendar-write and mail-attachment Graph API permissions granted to third-party/registered applications
  • Rotate and scope down Entra ID app registration client secrets associated with any suspected-compromised mailbox

Longer-term hardening

  • Deploy conditional access and continuous access evaluation on Entra ID to shorten the useful life of stolen OAuth2 client-credential tokens
  • Implement DNS tunneling detection (high-entropy subdomains, abnormal AAAA query volume/frequency) at the network egress layer
  • Establish supply-chain risk monitoring for managed IT/RMM providers given documented multi-hop compromise patterns in this threat cluster
  • Deploy application allow-listing / code-signing enforcement to disrupt DLL side-loading via trojanized legitimate binaries (e.g. WinDirStat)

Weaknesses (CWE) in HOLLOWGRAPH: .NET NativeAOT Malware Abusing Microsoft Graph

CWE-506, CWE-311, CWE-1188

Timeline of HOLLOWGRAPH: .NET NativeAOT Malware Abusing Microsoft Graph

  • Lyceum (HEXANE / Siamesekitten / Spirlin) first observed operating against oil & gas, telecom, aviation, and ISP targets across the Middle East and Africa.
  • Iranian MOIS-linked actor MuddyWater conducts targeting of Israeli organizations, cited by Check Point Research as historical precedent for MOIS-nexus tradecraft (XOR obfuscation, Base64 encoding, webshell handlers) overlapping with Cavern Manticore.
  • Lyceum .NET backdoor (SHA-256 315bdba98c6fe863d39f6afccc727e17d5aea63bf21259444fa988cae56d61c1) observed, later cited by Group-IB as a technical-overlap comparison point for HOLLOWGRAPH/Cavern.
  • Check Point Research begins tracking the Cavern Manticore modular C2 framework in the wild ('early 2026').
  • Earliest observed HOLLOWGRAPH C2 communication in the Group-IB observation window, marking the start of the tracked Israeli-entity intrusion set.
  • The Hacker News publishes coverage of the Cavern C2 framework targeting Israeli organizations, amplifying Check Point's SysAid-abuse findings ahead of the formal research report.
  • Check Point Research publishes 'Cavern Manticore: Exposing Iran-Linked Modular C2 Framework,' documenting the broader Cavern toolset, multi-hop IT-supply-chain compromise, and SysAid RMM abuse against Israeli government and IT-provider targets.
  • Latest observed HOLLOWGRAPH C2 communication during the Group-IB observation window; 3 of 12 identified infections still actively communicating.
  • Group-IB publishes 'HOLLOWGRAPH: Microsoft 365 Abuse Campaign,' disclosing the Graph API calendar-based C2 and DNS-tunneling credential-refresh mechanism, with low-confidence attribution to Cavern/Lyceum.

Update history for TL-2026-1553

Sources cited for HOLLOWGRAPH: .NET NativeAOT Malware Abusing Microsoft Graph

Threats related to HOLLOWGRAPH: .NET NativeAOT Malware Abusing Microsoft Graph

Detection coverage for TL-2026-1553

As of 2026-07-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1553 across Splunk SPL, Microsoft KQL and Sigma, covering 42 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-1553

1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats