HOLLOWGRAPH: when Microsoft 365 becomes a C2 server

Group-IB documented a Windows implant last week that uses your organization's own Microsoft 365 calendar as a command-and-control channel. The malware, named HOLLOWGRAPH, schedules calendar events dated May 13, 2050, hides stolen files inside them as attachments, and retrieves commands the same way. Every byte of that traffic flows over Microsoft Graph API endpoints, with the same TLS certificates and destination IP addresses as every other M365 activity on your network.

That is not a bug in Microsoft 365. It is the logical endpoint of a detection gap that has been widening for years: perimeter tools that flag anomalous destination IPs have no visibility into what an authenticated application is doing inside a legitimate SaaS platform.

What HOLLOWGRAPH does

HOLLOWGRAPH is a .NET NativeAOT-compiled DLL, part of a larger modular backdoor framework called Cavern. It supports exactly two commands: get (retrieve a tasking event from the compromised M365 mailbox) and send (exfiltrate a file as a calendar event attachment). The attacker controls the channel through a single compromised M365 account, not external infrastructure.

Every calendar event HOLLOWGRAPH creates carries a start date of May 13, 2050. That date choice is deliberate: it buries the events far outside the visible range of any normal calendar view. Stolen files are saved as attachments named File1.txt, File2.txt, and so on. The malware uses hybrid cryptography in both directions: RSA-OAEP wraps a freshly generated AES-256 session key, while AES-256-GCM encrypts the actual payload. Separate RSA key pairs are used for incoming commands and outgoing exfiltration, so compromising one direction of traffic does not expose the other.

Between sessions, DNS tunneling refreshes the credentials the malware uses to authenticate to the Graph API. Group-IB identified 12 confirmed victims, all in Israel, with C2 traffic logged from June 3 to July 9, 2026.

The Lyceum connection

HOLLOWGRAPH belongs to a framework Group-IB calls Cavern. Cavern shares structural characteristics with a .NET backdoor previously attributed to Lyceum, which is assessed as a sub-group of the Iranian OilRig cluster. The similarities include the modular plugin-loading mechanism and the general .NET architecture. Group-IB rates this attribution at low confidence, meaning the overlap is present but not definitive. A different group could have reused publicly available code or independently arrived at the same design.

For defenders, the attribution confidence level matters less than the targeting pattern: all 12 confirmed victims are in Israel, the campaign has been running since at least June 3, and the operational security is careful enough to avoid external C2 infrastructure entirely.

Why this detection gap matters

HOLLOWGRAPH works precisely because it abuses a legitimate, authenticated communication channel that most organizations actively allow and monitor only for content, not behavior. Microsoft Graph API calls to create calendar events, add attachments, or read calendar data are routine. A detection rule that blocks Graph API access would break Outlook, Teams, and every calendar integration in the enterprise.

This is the same pattern that drove earlier M365 abuse: device-code phishing to harvest tokens, HOLLOWGRAPH to misuse them. The Microsoft Graph API is an increasingly attractive C2 transport because it is high-trust, low-inspection, and available from almost any endpoint on corporate networks.

What defenders should do

The detection surface is the Graph API call pattern, not the network destination. Specifically:

• Add a detection rule in Microsoft Sentinel or Defender XDR for calendar event creation via Graph API where the event start date is beyond January 1, 2030. HOLLOWGRAPH uses May 2050; a 2030 threshold catches this with room for false-positive tuning.
• Alert on attachment creation in calendar events with generic sequential file names (File1.txt, File2.txt).
• Audit Microsoft Entra ID app registrations for any application granted mail, calendar read/write, or files scopes that is not a recognized first-party or approved third-party application.
• Treat M365 unified audit log coverage as a security requirement, not optional telemetry. HOLLOWGRAPH activity is visible in the Graph API audit trail, but only if audit log collection is enabled and retained.
• Review Group-IB's published IoC set for HOLLOWGRAPH command-and-control account indicators. Any match should be treated as an active intrusion, not a suspicious indicator.

The Cavern framework is modular, which means Group-IB may have documented only part of the capability set. Treat the calendar C2 module as the detected component of something larger.

Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you are assessing your organization's exposure to living-off-the-cloud attack techniques.