HollowGraph Malware Abuses Microsoft 365 Calendar as Covert C2 Channel (Cavern Framework, Suspected Cavern Manticore / Iran MOIS-Nexus)
HollowGraph Malware Abuses Microsoft 365 Calendar as Covert (TL-2026-1601), also tracked as HOLLOWGRAPH, is a high-severity malware campaign, first published 2026-07-21 and last reviewed 2026-07-24. It is attributed to Cavern Manticore (Iran) with low confidence, affects Microsoft Microsoft 365 / Microsoft Graph API (Entra ID tenant with, maps to 45 MITRE ATT&CK techniques (T1001, T1005, T1008), and is covered by 9 detection rules and 36 indicators of compromise.
Key facts for TL-2026-1601
- Threat ID
- TL-2026-1601
- Also known as
- HOLLOWGRAPH, Cavern (framework), Cav3rn
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-21
- Last reviewed
- 2026-07-24
- Attribution
- Cavern Manticore
- Attribution confidence
- LOW
- Nation-state nexus
- Iran
- Motivation
- ESPIONAGE
- Target sectors
- government administration, information-technology, managed-service-providers
- Target regions
- israel, Middle East
- Detection rules
- 9
- Indicators of compromise
- 36
- Updates
- 2026-07-24 · revalidated 1× · latest source
Malware and tooling in HollowGraph Malware Abuses Microsoft 365 Calendar as Covert
Malware and tooling: Cav3rn, Cavern, HollowGraph, WinDirStat
A newly documented .NET NativeAOT implant dubbed HollowGraph abuses compromised Microsoft 365 mailboxes and the Microsoft Graph API, treating the mailbox calendar as a two-way dead-drop for tasking and exfiltration secured with hybrid RSA-2048/AES-256-GCM encryption, with DNS tunneling over cloudlanecdn[.]com as a secondary channel for credential refresh. Group-IB attributes it with high confidence to the Cavern backdoor framework tracked by Check Point as used by the Iran MOIS-linked actor Cavern Manticore (low-confidence overlap with Lyceum/OilRig/MuddyWater); 12 Israeli victims identified, 3 actively communicating between June 3 and July 9, 2026.
How HollowGraph Malware Abuses Microsoft 365 Calendar as Covert works
HollowGraph is a .NET NativeAOT-compiled DLL implant that eliminates direct communication with attacker-controlled infrastructure for its primary channel, instead abusing the legitimate Microsoft Graph API against a pre-compromised Microsoft 365 / Entra ID tenant. The malware treats the compromised mailbox's calendar as a bidirectional dead-drop: operators plant tasking as calendar events dated far in the future (2050-05-13, 22:00-23:00 UTC) so the mailbox owner never scrolls to them, with instructions delivered as File{n}.txt attachments and event subjects following a bare-GUID or 'Boss{...}ID{...}' naming convention. The implant supports exactly two commands - 'get' (poll the calendar for planted tasking and decrypt the attached instructions with an embedded RSA private key) and 'send' (encrypt exfiltrated data with the C2 operator's RSA public key and upload it as an attachment to a newly created calendar event) - using the delimiter grammar '<command>_;;_<arg0>_,_<arg1>_,_<arg2>' that matches the broader Cavern framework's command syntax. Cryptography is hybrid RSA-OAEP (2048-bit, separate key pairs for inbound tasking and outbound exfiltration) wrapping an AES-256-GCM payload key. Configuration - Entra ID tenant ID, application (client) ID, client secret, target mailbox address, C2 domain, and the two RSA keys - is written to disk disguised as a routine log file named logAzure.txt. A secondary DNS tunneling channel resolves IPv6 AAAA records against cloudlanecdn[.]com to refresh these credentials in place, using a two-phase length/data query encoding ('{random}.{taskID}.{fieldIndex}.p.cloudlanecdn.com' for length, '.q.' for data, extracting 14 usable bytes per 16-byte IPv6 response).
Group-IB attributes HollowGraph, with high confidence, as a variant of the Cavern backdoor framework based on matching command syntax, matching C2 tasking JSON structure ({"cid":...,"type":"self","cmd":"003_;;__,_"}), and the shared self-command 'MzU=' (base64 for '003', a debug-logging toggle). Check Point Research separately profiled the broader modular Cavern C2 framework - evolved from an earlier 'Cav3rn' codebase - as used by an Iran-nexus actor it tracks as Cavern Manticore, assessed as MOIS-linked with technical overlap to MuddyWater and the OilRig subgroup Lyceum (aka Hexane, SiameseKitten). Cavern's full toolset comprises a Mixed-Mode C++/CLI agent (uxtheme.dll) sideloaded via a trojanized WinDirStat.exe delivered by abusing SysAid's legitimate deployment/update feature as a post-compromise lateral-tooling mechanism (Rescana's July 7, 2026 alert was corrected on July 9, 2026 to clarify SysAid itself was NOT exploited or supply-chain compromised — attackers were already operating inside the victim environment) or other RMM software footholds, plus NativeAOT (.NET 8) and .NET Framework 4.7.2 modules for HTTPS/WebSocket transport, file operations with DPAPI blob decryption, SQL database enumeration, LDAP/Active Directory reconnaissance and brute-forcing, SMB network scanning/brute-force, and a full SOCKS5/WebSocket tunneling proxy. Each module runs in an isolated .NET AppDomain that is unloaded post-execution, leaving no persistent in-memory assembly artifacts - a deliberate anti-forensics design. Both Group-IB and Check Point caution that attribution to a named, previously-identified threat actor remains low confidence despite the strong Cavern-family technical linkage; targeting is exclusively Israeli organizations, with Cavern Manticore additionally observed exploiting supply-chain trust relationships with Israeli IT providers to reach downstream victims. No CVE or software vulnerability is involved - the technique abuses legitimate, correctly-functioning Microsoft Graph API functionality through already-compromised Entra ID application credentials.
MITRE ATT&CK techniques used in TL-2026-1601
Command and Control
T1001 Data Obfuscation; T1008 Fallback Channels; T1071.001 Application Layer Protocol: Web Protocols; T1071.004 Application Layer Protocol: DNS; T1090.001 Proxy: Internal Proxy; T1095 Non-Application Layer Protocol; T1102.002 Web Service: Bidirectional Communication; T1568.003 Dynamic Resolution: DNS Calculation; T1573.001 Encrypted Channel: Symmetric Cryptography; T1573.002 Encrypted Channel: Asymmetric Cryptography
Collection
T1005 Data from Local System; T1074.001 Data Staged: Local Data Staging; T1119 Automated Collection; T1560.001 Archive Collected Data: Archive via Utility
Discovery
T1018 Remote System Discovery; T1046 Network Service Discovery; T1049 System Network Connections Discovery; T1069.002 Permission Groups Discovery: Domain Groups; T1087.002 Account Discovery: Domain Account; T1135 Network Share Discovery
Exfiltration
T1020 Automated Exfiltration; T1041 Exfiltration Over C2 Channel; T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
Lateral Movement
T1021.002 Remote Services: SMB/Windows Admin Shares; T1570 Lateral Tool Transfer
Defense Evasion
T1027 Obfuscated Files or Information; T1027.003 Obfuscated Files or Information: Steganography; T1036.005 Match Legitimate Resource Name or Location; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information
Persistence
T1078.004 Valid Accounts: Cloud Accounts; T1547.001 Registry Run Keys / Startup Folder; T1554 Compromise Host Software Binary
Credential Access
T1110.004 Brute Force: Credential Stuffing; T1552.001 Unsecured Credentials: Credentials In Files; T1555.004 Windows Credential Manager
Execution
Initial Access
T1133 External Remote Services; T1195.002 Compromise Software Supply Chain; T1199 Trusted Relationship; T1566.002 Spearphishing Link
lateral-movement
T1550 Use Alternate Authentication Material
stealth
Resource Development
T1583.001 Acquire Infrastructure: Domains; T1588.002 Obtain Capabilities: Tool
Affected products and versions in HollowGraph Malware Abuses Microsoft 365 Calendar as Covert
- Microsoft — Microsoft 365 / Microsoft Graph API (Entra ID tenant with compromised app-only OAuth credentials)
Vulnerable versions: N/A - technique abuse of legitimate cloud service, not a software vulnerability
Fixed in: N/A - SysAid — SysAid ITSM (deployment/update feature abused post-compromise for lateral tooling delivery in related Cavern Manticore intrusions; NOT a supply-chain exploit or vulnerability per Rescana's 2026-07-09 correction)
Vulnerable versions: N/A - legitimate feature abuse by an actor already inside the environment
Fixed in: N/A
Remediation for HollowGraph Malware Abuses Microsoft 365 Calendar as Covert
Immediate actions
- Sinkhole/block DNS resolution and network egress to cloudlanecdn[.]com and hospitalinstallation[.]com (and subdomains auth., google.com.)
- Search Entra ID / Microsoft 365 audit logs for application-driven (non-user) calendar event creation, attachment uploads, and subject edits
- Search Exchange Online / Microsoft Graph mailboxes for calendar events dated 2050-05-13 22:00-23:00 UTC with bare-GUID or 'Boss{...}ID{...}' subjects and File{n}.txt attachments
- Search endpoints for logAzure.txt, config.txt, Cvn.cfg.A, Cvn.cfg.U, and mutex MYMUTEX123HELLP
- Revoke and rotate client secrets for any OAuth2 client-credential application with unexplained Mail.ReadWrite/Calendars.ReadWrite Graph scopes
Workarounds
- Restrict Microsoft Graph Calendars.ReadWrite and Mail.Read/ReadWrite application permissions to only applications with an explicit, documented business need
Longer-term hardening
- Enforce Conditional Access policies restricting client-credential (app-only) Graph API grants and alert on newly created client secrets
- Deploy anomalous OAuth token / impossible-travel detection for Entra ID service principals
- Audit and restrict Remote Monitoring and Management (RMM) software deployment/update features (e.g., SysAid) against abuse for lateral DLL side-loading delivery by an actor already inside the environment (SysAid itself was not exploited or supply-chain compromised)
- Deploy DNS monitoring for high-entropy, high-frequency IPv6 AAAA subdomain queries indicative of tunneling
- Harden LDAP/Active Directory against brute-force enumeration and disable unauthenticated/legacy bind where possible
Weaknesses (CWE) in HollowGraph Malware Abuses Microsoft 365 Calendar as Covert
CWE-506, CWE-311, CWE-522
Timeline of HollowGraph Malware Abuses Microsoft 365 Calendar as Covert
- Check Point Research begins tracking Cavern Manticore activity ('early 2026').
- Earliest observed communication between a HollowGraph victim mailbox and attacker-planted calendar tasking.
- The Hacker News, SecurityWeek, and The Jerusalem Post publish independent coverage of the Check Point Cavern Manticore report, describing exploitation combining vulnerability abuse, Outlook Web Access (OWA) brute-force attacks, and newly identified C2 controllers targeting Israeli government/IT organizations.
- Check Point Research publishes 'Cavern Manticore: Exposing Iran-Linked Modular C2 Framework', profiling the modular Cavern C2 framework, its module set, and the Iran-nexus MOIS attribution.
- Rescana publishes an initial active-exploitation alert describing Cavern Manticore's abuse of SysAid's deployment/update feature as a post-compromise foothold mechanism.
- End of Group-IB's HollowGraph observation window; 12 total infected systems identified, 3 actively communicating.
- Rescana issues a correction to its alert clarifying that SysAid itself was NOT compromised and no SysAid vulnerability was involved; attackers were already operating inside the victim environment and abused SysAid's legitimate deployment features for lateral tooling delivery, not a supply-chain exploit.
- SecurityWeek, The Hacker News, BleepingComputer, Infosecurity Magazine, and securityonline.info publish coverage of the HollowGraph disclosure.
- Group-IB publishes 'HOLLOWGRAPH: Turning Microsoft 365 Calendars into Covert Command-and-Control Channels', disclosing the calendar dead-drop technique and attributing it to the Cavern framework with high confidence.
- SentinelOne's 'Week 30' cybersecurity roundup aggregates and amplifies the HOLLOWGRAPH/Cavern Manticore disclosures, prompting a secondary hunt pass.
Update history for TL-2026-1601
- 2026-07-24 — HollowGraph: Suspected Iran-Linked .NET Espionage Implant Abusing Microsoft 365 Calendar as C2 Dead-Drop, Tied to Cavern Manticore Framework: What changed No field escalations — severity (HIGH), exploitability (ACTIVE), status (ACTIVE), and attribution confidence (LOW) are unchanged. The newer report adds a handful of previously-undocumented Cavern module hashes (including a db.d
Sources cited for HollowGraph Malware Abuses Microsoft 365 Calendar as Covert
- New HollowGraph Malware Abuses Microsoft 365 Calendar for C&C Communication
- HOLLOWGRAPH: Turning Microsoft 365 Calendars into Covert Command-and-Control Channels
- Cavern Manticore: Exposing Iran-Linked Modular C2 Framework
- HollowGraph Malware Hides C2 and Stolen Files in Microsoft 365 Events Dated 2050
- New HollowGraph malware uses Microsoft Graph for stealthy C2 comms
- New HollowGraph Malware Hijacks Microsoft 365 Calendars for Covert C2
- HOLLOWGRAPH Malware Abuses Microsoft Graph API for C2
- Iran-Linked Hackers Use New Cavern C2 Framework to Target Israeli Organizations
- Iran-Linked Hackers Using Modular C&C Framework in Cyberattacks
- Active Exploitation Alert: Iranian Cavern Manticore APT Abuses SysAid Supply Chain With Modular Cavern C2 Malware Targeting Israeli Organizations
- Iran-linked hacker group Cavern Manticore targets Israeli IT, government sectors
Threats related to HollowGraph Malware Abuses Microsoft 365 Calendar as Covert
- HOLLOWGRAPH: .NET NativeAOT Malware Abusing Microsoft Graph API and M365 Calendar Events for C2, Linked to Cavern Manticore/Lyceum (Low Confidence)
- Project CAV3RN / Cavern Manticore: Iran-Linked Modular Cyberespionage Framework Abuses Outlook Calendar (Microsoft Graph API) and DNS AAAA Records for C2 and Credential Recovery
- HOLLOWGRAPH: Microsoft 365 Calendar-Based C2 Malware Targeting Israeli Organizations (Cavern Manticore)
- Cavern Manticore: Iran-Linked Modular .NET C2 Framework Targeting Israeli Government and IT Sectors via SysAid RMM Abuse
- Cavern Manticore's CAV3RN C2 Framework Adds DNS-Based Channel Selection and Google Apps Script Relay
- HollowGraph Malware Abuses Microsoft 365 Calendars for Covert C2 via Graph API
Detection coverage for TL-2026-1601
As of 2026-07-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1601 across Splunk SPL, Microsoft KQL and Sigma, covering 36 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-1601
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.