HollowGraph Malware Abuses Microsoft Graph API and M365 Calendar Events (Future-Dated 2050) for Stealthy Command-and-Control
HollowGraph Malware Abuses Microsoft Graph API and M365 (TL-2026-1561), also tracked as HollowGraph, is a high-severity malware campaign, first published 2026-07-20. It is attributed to Cavern Manticore (Iran) with low confidence, affects Microsoft Microsoft 365 / Microsoft Graph API, maps to 21 MITRE ATT&CK techniques (T1020, T1027, T1036.005), and is covered by 9 detection rules and 15 indicators of compromise.
Key facts for TL-2026-1561
- Threat ID
- TL-2026-1561
- Also known as
- HollowGraph
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-20
- Last reviewed
- 2026-07-20
- Attribution
- Cavern Manticore
- Attribution confidence
- LOW
- Nation-state nexus
- Iran
- Motivation
- ESPIONAGE
- Target sectors
- government administration, critical-infrastructure-adjacent unconfirmed israel-based organization
- Target regions
- israel, Middle East
- Detection rules
- 9
- Indicators of compromise
- 15
Malware and tooling in HollowGraph Malware Abuses Microsoft Graph API and M365
Malware and tooling: Cavern, HollowGraph
HollowGraph is a .NET DLL espionage implant that abuses compromised Microsoft 365 mailbox credentials and the Microsoft Graph API to run a covert command-and-control channel through calendar events future-dated to May 13, 2050, backed by a DNS-tunneling channel over IPv6 AAAA records to cloudlanecdn[.]com for credential refresh. Group-IB links the malware's command syntax with high confidence to the Cavern/Cavern Manticore backdoor framework (assessed as Iranian MOIS-affiliated), with a low-confidence technical overlap noted to the Iranian espionage actor Lyceum (HEXANE/Siamesekitten), though no confident attribution to a specific named group has been made.
How HollowGraph Malware Abuses Microsoft Graph API and M365 works
HollowGraph is a newly documented .NET DLL-based espionage implant discovered by Group-IB that weaponizes legitimate, trusted Microsoft 365 infrastructure as a command-and-control (C2) dead drop, requiring no exploited vulnerability -- only a compromised mailbox account and Microsoft Graph API access. The malware authenticates to the Microsoft Graph API using stolen Microsoft 365 mailbox credentials (Entra ID tenant ID, application/client ID, and client secret) and then uses the target mailbox's Calendar feature as a covert two-way communication channel. The operator plants tasking inside calendar events deliberately future-dated to 2050-05-13, with a fixed retrieval/activity window of 22:00-23:00 UTC on that date, so that the implant's beaconing traffic and the associated calendar objects blend into ordinary, rarely-audited M365 activity and evade time-based detection heuristics. Two commands are supported: GET, in which the implant searches the calendar for operator-planted events (subject patterns such as 'Event ID: <7-char-taskID>' or bare GUIDs), downloads the attached tasking, and decrypts it; and SEND, in which the implant creates new calendar events (subject pattern 'Boss{..}ID{..}') with encrypted stolen data attached as files named in a 'File{n}.txt' pattern for exfiltration. All Graph-channel payloads are protected with a hybrid RSA + AES-256-GCM encryption scheme using two distinct RSA key pairs -- one per communication direction (inbound tasking vs. outbound exfiltrated data) -- so that operator and implant traffic cannot be decrypted by intercepting a single key. A secondary, unencrypted DNS-tunneling channel is used strictly for credential refresh: the implant issues DNS queries for IPv6 AAAA records against the attacker-registered domain cloudlanecdn[.]com, and each returned IPv6 address is used to smuggle 14 usable payload bytes, which are reassembled to deliver updated Microsoft Entra ID credentials (tenant ID, client ID, client secret, target mailbox address) and the C2 domain itself. All configuration state -- credentials, RSA keys, C2 domain, mailbox target -- is persisted locally to a file named logAzure.txt, styled to blend in among legitimate Azure/Entra logging artifacts. Group-IB observed at least 12 infected systems, of which 3 were actively communicating with the C2 infrastructure between June 3, 2026 and July 9, 2026, indicating a small, deliberately narrow, highly targeted operation rather than a mass-scale campaign; targeting is assessed to be focused on an organization in Israel, consistent with an espionage rather than financially motivated objective. On the command syntax, Group-IB matched the implant's tasking format (compact key-value strings such as '{"cid": "oXhLaJ0ZvtPb9XB", "type": "self", "cmd": "003_;;__,_"}' and command codes such as base64 'MzU=' decoding to '003', a debug-logging toggle) to the previously catalogued Cavern backdoor framework with high confidence, attributing infrastructure overlap to the Cavern Manticore cluster, which is separately assessed by other researchers as linked to Iran's Ministry of Intelligence and Security (MOIS) and to share tradecraft with MuddyWater and Lyceum/OilRig-adjacent operators. A weaker, low-confidence technical overlap was additionally noted between HollowGraph and Lyceum (aka HEXANE, Siamesekitten, Spirlin, Chrono Kitten, MarnanBridge), an Iranian-nexus espionage group active since at least 2017 against energy, telecom, aviation, ISP, and government targets in the Middle East and Africa, previously known for DNS-based backdoors (DanBot, DnsSystem, Milan, Kevin, Shark) and use of the open-source tools Empire, Mimikatz, and PoshC2. Group-IB explicitly states it cannot confidently attribute HollowGraph to any single previously identified threat actor. Because the abuse relies entirely on legitimate Graph API functionality and valid (stolen) OAuth/Entra ID credentials rather than a software vulnerability, no vendor patch applies; defensive guidance centers on identity and access controls -- auditing and restricting client-credential OAuth applications with Graph permissions, alerting on newly created client secrets, enforcing Conditional Access and credential rotation, deploying anomalous token/impossible-travel detection, auditing Graph and mailbox audit logs for app-driven calendar create/read events (especially events dated far in the future), and hunting for anomalous outbound IPv6 AAAA DNS queries and high-entropy subdomain patterns consistent with tunneling.
MITRE ATT&CK techniques used in TL-2026-1561
Exfiltration
T1020 Automated Exfiltration; T1041 Exfiltration Over C2 Channel; T1567.002 Exfiltration to Cloud Storage
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location
Execution
T1059 Command and Scripting Interpreter
Command and Control
T1071.001 Web Protocols; T1071.004 DNS; T1102.001 Dead Drop Resolver; T1102.002 Bidirectional Communication; T1132.001 Standard Encoding; T1571 Non-Standard Port; T1573.002 Asymmetric Cryptography
Collection
Initial Access
Persistence
T1098.001 Additional Cloud Credentials
Discovery
Credential Access
T1528 Steal Application Access Token; T1552.001 Credentials In Files
lateral-movement
T1550.001 Application Access Token
Impact
Affected products and versions in HollowGraph Malware Abuses Microsoft Graph API and M365
- Microsoft — Microsoft 365 / Microsoft Graph API
Vulnerable versions: all tenants with compromised mailbox credentials and Graph API OAuth access - Microsoft — Microsoft Entra ID (OAuth client-credential applications)
Vulnerable versions: all tenants issuing client-credential grants without conditional access controls
Remediation for HollowGraph Malware Abuses Microsoft Graph API and M365
Patches
- No vendor patch applies -- HollowGraph abuses legitimate Microsoft Graph API functionality via valid stolen credentials, not a software vulnerability
Immediate actions
- Block outbound DNS resolution to cloudlanecdn[.]com and monitor for high-entropy AAAA record queries to unfamiliar domains
- Hunt Microsoft 365 mailboxes for calendar events dated far in the future (e.g. year 2050) or with subject patterns matching 'Event ID:' or 'Boss{..}ID{..}'
- Search endpoints for the presence of a file named logAzure.txt and treat any hit as a confirmed compromise indicator
- Revoke and rotate credentials, client secrets, and OAuth app registrations for any mailbox exhibiting anomalous Graph API calendar activity
- Force sign-out and re-authentication with Conditional Access enforcement for affected Microsoft 365 tenants
Workarounds
- Restrict Calendars.ReadWrite and broad Graph API mailbox permissions for OAuth applications to only those with a documented business need
- Enforce Conditional Access policies requiring managed-device and MFA for any Graph API application token issuance
- Enable and monitor Microsoft Purview / Unified Audit Log for calendar item creation via application (non-interactive) identities
Longer-term hardening
- Implement continuous auditing of Entra ID client-credential OAuth application grants and alert on newly created client secrets
- Deploy anomalous/impossible-travel token detection for Microsoft Graph API access
- Establish DNS tunneling detection (query volume, AAAA record entropy, NXDOMAIN ratio) across the enterprise resolver layer
- Extend SOC log review baselines to include Microsoft Graph and mailbox audit logs, not just endpoint/network telemetry
- Apply least-privilege Graph API permission scoping to all registered applications, especially Calendars.ReadWrite and Mail.Read
Timeline of HollowGraph Malware Abuses Microsoft Graph API and M365
- Lyceum (HEXANE/Siamesekitten), the Iranian-nexus actor later noted for low-confidence technical overlap with HollowGraph, is first observed active against energy and telecom targets in the Middle East and Africa.
- Bahrain NCSC publishes advisory on a new .NET-based DNS backdoor used by Lyceum, establishing the actor's history of DNS-based C2 tradecraft referenced in HollowGraph attribution analysis.
- Earliest observed active communication between an infected system and HollowGraph C2 infrastructure, per Group-IB telemetry.
- Rescana publishes an initial alert on Iranian Cavern Manticore APT activity abusing SysAid-adjacent infrastructure with modular Cavern C2 malware targeting Israeli organizations, based on Check Point Research documentation -- the same Cavern framework later matched to HollowGraph's command syntax.
- Rescana issues a correction to its July 7, 2026 Cavern Manticore alert, clarifying that the campaign involved abuse of SysAid-adjacent infrastructure rather than a genuine SysAid software supply-chain compromise.
- Most recent observed active communication between an infected system and HollowGraph C2 infrastructure.
- The Hacker News, Infosecurity Magazine, and other outlets publish additional coverage summarizing Group-IB's HollowGraph findings and IOCs.
- BleepingComputer publishes its HollowGraph coverage (article timestamped 01:43 PM, authored by Bill Toulas), summarizing Group-IB's findings, the Graph API/calendar C2 mechanism, and the Cavern/Lyceum attribution nuance.
- Group-IB publicly discloses HollowGraph malware, its Microsoft Graph API / calendar-based C2 mechanism, DNS-tunneling credential-refresh channel, and high-confidence linkage to the Cavern backdoor framework.
- Date embedded by the threat actor into HollowGraph's calendar-based tasking events (activity window 22:00-23:00 UTC) as a deliberate future-dating evasion technique -- not a real operational date, but the value hardcoded into the malware's calendar dead-drop logic.
Sources cited for HollowGraph Malware Abuses Microsoft Graph API and M365
- New HollowGraph malware uses Microsoft Graph for stealthy C2 comms
- HollowGraph Malware Hides C2 and Stolen Files in Microsoft 365 Events Dated 2050
- New HollowGraph Malware Hijacks Microsoft 365 Calendars for Covert C2
- HOLLOWGRAPH: Attackers Turn Outlook Calendar Into a Secret Command Channel
- New Malware Campaign Exploits Microsoft Graph API to Infect Windows
- What We Can Learn from The New Malware Abusing Microsoft
- HEXANE, Lyceum, Siamesekitten, Spirlin, Group G1001 | MITRE ATT&CK
- Active Exploitation Alert: Iranian Cavern Manticore APT Abuses SysAid Supply Chain With Modular Cavern C2 Malware Targeting Israeli Organizations
- LYCEUM (Threat Actor) - Malpedia
- TLP:WHITE A new .NET-based DNS Backdoor Used by Lyceum
Threats related to HollowGraph Malware Abuses Microsoft Graph API and M365
- HollowGraph Malware Abuses Microsoft 365 Calendar as Covert C2 Channel (Cavern Framework, Suspected Cavern Manticore / Iran MOIS-Nexus)
- Cavern Manticore's CAV3RN C2 Framework Adds DNS-Based Channel Selection and Google Apps Script Relay
- HOLLOWGRAPH: .NET NativeAOT Malware Abusing Microsoft Graph API and M365 Calendar Events for C2, Linked to Cavern Manticore/Lyceum (Low Confidence)
- Project CAV3RN / Cavern Manticore: Iran-Linked Modular Cyberespionage Framework Abuses Outlook Calendar (Microsoft Graph API) and DNS AAAA Records for C2 and Credential Recovery
- HollowGraph Malware Abuses Microsoft 365 Calendars for Covert C2 via Graph API
- HOLLOWGRAPH: Microsoft 365 Calendar-Based C2 Malware Targeting Israeli Organizations (Cavern Manticore)
Detection coverage for TL-2026-1561
As of 2026-07-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1561 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.