New HollowGraph Malware Exploits Microsoft Graph for Stealthy C2 Communication

HollowGraph is a sophisticated malware component that exploits the calendar features of compromised Microsoft 365 mailboxes, using them as a stealthy command-and-control (C2) channel to receive attacker commands and siphon stolen data.

Researchers have linked this malware to the Cavern framework, previously associated with Iranian threat actors targeting Israeli organizations.

At least 12 systems have been compromised by HollowGraph, with three actively communicating with the attackers between June 3 and July 9, highlighting the immediate threat posed by this malware.

Indicators gathered during the investigation suggest that attackers are specifically targeting Israeli entities, indicating a pattern of espionage-centric attacks.

Abuse of Microsoft 365 Mailbox

According to a report from cybersecurity firm Group-IB, HollowGraph utilizes hard-coded credentials to authenticate through the Microsoft Graph API using compromised Microsoft 365 accounts.

The malware saves its configuration file as logAzure.txt, mimicking a regular log file, which contains critical data such as the Microsoft Entra ID tenant ID, application (client) ID, client secret, target mailbox address, C2 domain, and two RSA keys.

These keys are utilized for encrypting the file before sending it to the attacker and for decrypting commands received from the attacker.

To avoid detection, attackers create calendar events, titled in a specific format, scheduled for May 13, 2050. Commands and exfiltrated files are concealed within attachments to these calendar entries.

According to Group-IB’s analysis, HollowGraph supports two primary commands to operate:

• GET, 'Event ID: <7-char-taskID>”: Downloads and decrypts the received instructions.
• Send: Generates a calendar entry in the format “Boss{..}ID{..}” and attaches stolen data encrypted with a public RSA key.

Researchers characterize the mailbox calendar as a “secret dead drop,” with HollowGraph accepting commands from events scheduled in a narrow one-hour window between 22:00 and 23:00 UTC on May 13, 2050.

Group-IB reveals that a hybrid encryption method, combining RSA with AES-256-GCM algorithms, is being used to secure communications over Microsoft Graph, effectively separating inbound and outbound channels cryptographically.

In addition to the encrypted channel, HollowGraph employs a secondary unencrypted communication pathway via DNS tunneling to update Microsoft Entra ID credentials (tenantId, clientId, clientSecret, and mailbox) utilized for Microsoft Graph authentication.

These values can be obtained by querying an IPv6 AAAA record from the attacker-controlled domain cloudlanecdn.[.]com and subsequently updating logAzure.txt.

Group-IB states, “For each returned IPv6 address (16 bytes), there are 14 usable payload bytes.” The malware then assembles this data into a payload, decodes it as UTF-8 text, and organizes the result based on its configuration fields.

While researchers remain uncertain if HollowGraph can be definitively attributed to a specific threat actor, they noted that there are technical similarities to Lyceum, an Iran-linked group. However, sufficient evidence for attribution is lacking.

Research suggests organizations closely monitor Microsoft Graph and Microsoft 365 audit logs for any suspicious calendar activity, particularly for entries set far into the future or containing unusual subjects or attachments.

We recommend vigilant monitoring for indicators such as the domain cloudlanecdn.[.]com and the logAzure.txt file to implement strict conditional access policies, audit OAuth client credential applications, and scrutinize outbound DNS queries for potential tunneling patterns.

Security teams document only 54% of successful attacks and issue warnings on just 14%. The remaining incidents go unnoticed.

Picus’ whitepaper details how to assess your SIEM and EDR rules through breach and attack simulations to ensure threats are detected timely.

Download the white paper