HollowGraph Malware Abuses Microsoft 365 Calendars for Covert C2 via Graph API
HollowGraph Malware Abuses Microsoft 365 Calendars for (TL-2026-1555), also tracked as HollowGraph, is a high-severity malware campaign, first published 2026-07-20 and last reviewed 2026-07-29. It is attributed to Cavern backdoor framework (Iran) with medium confidence, affects Microsoft Microsoft 365 (Calendar/Outlook), maps to 53 MITRE ATT&CK techniques (T1001, T1005, T1008), and is covered by 9 detection rules and 45 indicators of compromise.
Key facts for TL-2026-1555
- Threat ID
- TL-2026-1555
- Also known as
- HollowGraph
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-20
- Last reviewed
- 2026-07-29
- Attribution
- Cavern backdoor framework
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Iran
- Motivation
- ESPIONAGE
- Target sectors
- government administration, information-technology, managed-service-providers
- Target regions
- Middle East, israel
- Detection rules
- 9
- Indicators of compromise
- 45
- Updates
- 2026-07-29 · revalidated 1× · latest source
Malware and tooling in HollowGraph Malware Abuses Microsoft 365 Calendars for
Malware and tooling: Cav3rn, Cavern, Cavern Manticore, HollowGraph, SysAid, WinDirStat
HollowGraph is a Windows backdoor that turns compromised Microsoft 365 calendars into a covert command-and-control channel via the Microsoft Graph API, using DNS tunneling to deliver Entra ID credentials and hybrid RSA/AES-256-GCM encryption to protect Graph traffic. It is attributed with high confidence to the Cavern backdoor framework, which shows technical overlap with the Iranian-nexus actor Lyceum (an OilRig subgroup), though attribution to a specific named actor is not confirmed.
How HollowGraph Malware Abuses Microsoft 365 Calendars for works
Group-IB researchers identified HollowGraph in a narrowly scoped campaign against Israeli entities, with 12 confirmed infected systems and observed activity spanning June 3, 2026 to July 9, 2026. Rather than beaconing to attacker-owned infrastructure, HollowGraph abuses the Microsoft Graph API to read and write Microsoft 365 calendar appointments on a compromised mailbox: a 'send' command generates calendar appointments carrying encrypted stolen files as attachments, while a 'get' command searches for operator-planted appointments and retrieves attached instructions. Because all C2 traffic transits Microsoft's own trusted infrastructure, the technique evades network-perimeter and reputation-based defenses that would flag contact with attacker-owned domains. Separately, an unencrypted DNS-tunneling channel is used to deliver and refresh Microsoft Entra ID (Azure AD) OAuth credentials needed to authenticate to Graph. Graph communications themselves are protected by a hybrid encryption scheme combining RSA (for key exchange) and AES-256-GCM (for payload confidentiality/integrity), with distinct RSA key pairs used per communication direction (inbound vs outbound). Command parsing follows a distinctive delimiter format (`<command>_;;_<arg0>_,_<arg1>_,_<arg2>`) and Base64-encoded numeric command IDs (e.g., `MzU=` decodes to `003`, a debug-logging toggle) consistent with artifacts previously documented in the Cavern / Cavern Manticore .NET post-exploitation framework. Cavern Manticore is a modular, multi-format (.NET Framework / Mixed-Mode C++/CLI / Native AOT) C2 framework linked to Iran's MOIS with technical overlap to OilRig's Lyceum subgroup and MuddyWater; it has previously been deployed via DLL side-loading against a trojanized WinDirStat.exe following a SysAid RMM supply-chain compromise, and includes modules for credential access (DPAPI decryption, LDAP/SMB brute force), lateral movement (SMB admin shares, network drive mapping), network reconnaissance (port scanning, SOCKS5 tunneling), and data staging/archival. The small, targeted victim count and exclusive focus on Israeli entities point to a deliberate espionage operation rather than opportunistic crimeware. HollowGraph and the broader Cavern/Lyceum technique set reflect a wider trend of nation-state actors abusing native Microsoft cloud services (Graph API, Outlook/OAuth tokens as seen in FINALDRAFT/SIESTAGRAPH) to host C2 inside traffic that blends into normal enterprise SaaS usage.
MITRE ATT&CK techniques used in TL-2026-1555
Command and Control
T1001 Data Obfuscation; T1008 Fallback Channels; T1071 Application Layer Protocol; T1090 Proxy; T1102 Web Service; T1102.002 Bidirectional Communication; T1104 Multi-Stage Channels; T1132 Data Encoding; T1132.001 Standard Encoding; T1568 Dynamic Resolution; T1572 Protocol Tunneling; T1573 Encrypted Channel; T1573.001 Symmetric Cryptography; T1573.002 Asymmetric Cryptography
Collection
T1005 Data from Local System; T1074.001 Local Data Staging; T1113 Screen Capture; T1114 Email Collection; T1123 Audio Capture; T1560 Archive Collected Data
Discovery
T1012 Query Registry; T1018 Remote System Discovery; T1046 Network Service Discovery; T1057 Process Discovery; T1083 File and Directory Discovery; T1087 Account Discovery; T1087.002 Domain Account; T1135 Network Share Discovery
Exfiltration
T1020 Automated Exfiltration; T1041 Exfiltration Over C2 Channel; T1048 Exfiltration Over Alternative Protocol
Lateral Movement
T1021 Remote Services; T1570 Lateral Tool Transfer
Defense Evasion
T1027 Obfuscated Files or Information; T1027.002 Software Packing; T1036 Masquerading; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information
Execution
T1059 Command and Scripting Interpreter; T1129 Shared Modules; T1204 User Execution
Initial Access
T1078.004 Cloud Accounts; T1195 Supply Chain Compromise; T1195.002 Compromise Software Supply Chain; T1199 Trusted Relationship
Credential Access
T1110 Brute Force; T1528 Steal Application Access Token; T1552.001 Credentials In Files; T1555 Credentials from Password Stores
stealth
Resource Development
T1583 Acquire Infrastructure; T1587 Develop Capabilities
Reconnaissance
Affected products and versions in HollowGraph Malware Abuses Microsoft 365 Calendars for
- Microsoft — Microsoft 365 (Calendar/Outlook)
Vulnerable versions: cloud service - all tenants - Microsoft — Microsoft Graph API
Vulnerable versions: cloud service - all tenants - Microsoft — Microsoft Entra ID (Azure AD)
Vulnerable versions: cloud service - all tenants - Microsoft — Windows
Vulnerable versions: client endpoints running HollowGraph/Cavern implant - WinDirStat — WinDirStat.exe
Vulnerable versions: trojanized via DLL side-loading of uxtheme.dll - SysAid — SysAid ITSM
Vulnerable versions: software update channel abused as supply-chain vector in Cavern deployments
Remediation for HollowGraph Malware Abuses Microsoft 365 Calendars for
Immediate actions
- Audit Microsoft Entra ID app registrations and OAuth consent grants for anomalous Mail.Read/Calendars.ReadWrite Graph API scopes
- Enable Microsoft 365 mailbox audit logging and alert on calendar event creation/attachment uploads performed by applications rather than interactive users
- Block or heavily scrutinize outbound DNS TXT-record-heavy traffic consistent with DNS tunneling
- Revoke and rotate credentials/refresh tokens for any account showing anomalous Graph API calendar activity
- Hunt for WinDirStat.exe execution paired with unsigned or unexpected uxtheme.dll side-loading
Workarounds
- Restrict application-level Graph API permissions to least privilege; disable unused Calendars/Mail scopes for service principals
- Disable legacy authentication protocols that facilitate token theft/replay against Entra ID
Longer-term hardening
- Deploy Cloud Access Security Broker (CASB) or native M365 anomaly detection tuned to Graph API calendar/mail abuse patterns
- Restrict and monitor RMM/ITSM software (e.g., SysAid) update channels as a supply-chain entry point
- Implement conditional access policies restricting Graph API token issuance to managed/compliant devices
- Deploy DNS security monitoring capable of detecting tunneling (entropy analysis, query volume/TXT record anomalies)
Timeline of HollowGraph Malware Abuses Microsoft 365 Calendars for
- Lyceum (Hexane/Spilrin), the Iranian-nexus actor showing technical overlap with the Cavern framework, is first tracked as active, historically targeting telecom and energy sector organizations in the Middle East.
- Zscaler and other researchers publish analysis of a Lyceum .NET-based DNS backdoor using DIG.net-derived DNS tunneling for command execution and exfiltration, establishing the DNS-tunneling TTP later echoed in HollowGraph's credential-delivery channel.
- SIESTAGRAPH, an earlier backdoor abusing the Microsoft Graph API/Outlook mail service for C2, is first reported, establishing precedent for nation-state abuse of Graph API-based covert channels later refined in FINALDRAFT and HollowGraph.
- Check Point Research begins tracking the modular Cavern Manticore C2 framework in early 2026, documenting three iteratively-developed agent builds (an initial build, 'build 02' adding JSON configuration and WebSocket support, and 'build 04' refining configuration while retaining WebSocket transport) later linked to HollowGraph.
- The U.S. and Israel launch the joint military campaign against Iran codenamed 'Operation Epic Fury' (U.S.) / 'Operation Roaring Lion' (Israel), running through 2026-05-05; Check Point observed Cavern Manticore's operational tempo as notably high and its target selection as disciplined during this period.
- Earliest observed HollowGraph activity against Israeli entities begins; first Graph API calendar-based C2 communication recorded against a compromised Israeli mailbox.
- Check Point Research publishes 'Cavern Manticore: Exposing Iran-Linked Modular C2 Framework,' detailing the .NET/Mixed-Mode/Native AOT Cavern implant family, its WinDirStat/uxtheme.dll side-loading delivery, SysAid-abuse supply-chain entry point, and hospitalinstallation[.]com infrastructure later corroborating the HollowGraph attribution to Cavern.
- Trade press (GBHackers, Infosecurity Magazine, SC Media) republish and analyze the Check Point Cavern Manticore findings, reporting the actor's targeting of Israeli IT-supply-chain and government-sector organizations via SysAid update-mechanism abuse.
- Latest confirmed HollowGraph activity observed before research disclosure; 12 infected systems identified in total, with malware files and compromised infrastructure traced back to Israel.
- Group-IB publishes research on HollowGraph and its Cavern/Lyceum technical overlap; Infosecurity Magazine publishes corroborating coverage the same day, citing Microsoft 365 audit-log detection indicators (anomalous application-driven calendar event creation, attachment uploads, and subject-line modifications).
- Trade and security press (The Hacker News, The Register, BleepingComputer, Infosecurity Magazine, GBHackers, Cyber Security News, uvcyber) republish and analyze the Group-IB HollowGraph findings.
- Picus Security cites and analyzes the Group-IB HollowGraph research, cataloguing it as Threat Library entry #49009 under its Network Infiltration module for detection/simulation coverage.
- Picus Security publishes 'HOLLOWGRAPH Backdoor Turns Microsoft 365 Calendars Into a C2 Channel,' the secondary-source article that triggered this revalidation.
Update history for TL-2026-1555
- 2026-07-29 — HOLLOWGRAPH Backdoor Abuses Microsoft 365 Calendars as C2 Channel: What changed No severity/exploitability/status/attribution escalation — both reports agree on HIGH severity, ACTIVE exploitability, and MEDIUM-confidence Cavern/Cavern-Manticore technical linkage. The update deepens technical fidelity: a se
Sources cited for HollowGraph Malware Abuses Microsoft 365 Calendars for
- New HollowGraph Malware Hijacks Microsoft 365 Calendars for Covert C2 Communications
- Cavern Manticore: Exposing Iran-Linked Modular C2 Framework
- Lyceum .NET DNS Backdoor
- Iranian hackers target energy sector with new DNS backdoor
- Lyceum .NET DNS Backdoor Detection: Iranian Nation-Backed APT Group Leverages New Hijacking Malware
- Lyceum APT uses a DNS backdoor to hit the telecom and energy sectors
- From Graph API to Tor, malware gets creative with C2
- Iranian Threat Actors: What Defenders Need to Know
Threats related to HollowGraph Malware Abuses Microsoft 365 Calendars for
- HOLLOWGRAPH: Microsoft 365 Calendar-Based C2 Malware Targeting Israeli Organizations (Cavern Manticore)
- HollowGraph Malware Abuses Microsoft 365 Calendar as Covert C2 Channel (Cavern Framework, Suspected Cavern Manticore / Iran MOIS-Nexus)
- Project CAV3RN / Cavern Manticore: Iran-Linked Modular Cyberespionage Framework Abuses Outlook Calendar (Microsoft Graph API) and DNS AAAA Records for C2 and Credential Recovery
- HOLLOWGRAPH: .NET NativeAOT Malware Abusing Microsoft Graph API and M365 Calendar Events for C2, Linked to Cavern Manticore/Lyceum (Low Confidence)
- Cavern Manticore: Iran-Linked Modular .NET C2 Framework Targeting Israeli Government and IT Sectors via SysAid RMM Abuse
- Cavern Manticore's CAV3RN C2 Framework Adds DNS-Based Channel Selection and Google Apps Script Relay
Detection coverage for TL-2026-1555
As of 2026-07-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1555 across Splunk SPL, Microsoft KQL and Sigma, covering 45 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-1555
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.