Full Report
Malware hides commands in appointments set for 2050 and uses Redmond's own cloud to phone home
Analysis Summary
# Tool/Technique: HOLLOWGRAPH
## Overview
HOLLOWGRAPH is a specialized espionage malware component designed to facilitate stealthy command-and-control (C2) and data exfiltration. It achieves persistence and evasion by abusing legitimate Microsoft 365 (M365) infrastructure, specifically utilizing the Microsoft Graph API to communicate via compromised calendar accounts rather than traditional attacker-controlled servers.
## Technical Details
- **Type:** Malware Component / Implant
- **Platform:** Windows (typically associated with M365 environments)
- **Capabilities:** Microsoft Graph API abuse, C2 via calendar events, DNS tunneling for credential refreshment, data exfiltration.
- **First Seen:** Publicized July 2026 (Reported by Group-IB)
## MITRE ATT&CK Mapping
- **[TA0011 - Command and Control]**
- **[T1102.002 - Web Service: Bidirectional Communication]**: Uses Microsoft Graph API/Calendar for C2.
- **[T1568.003 - Dynamic Resolution: DNS Tunneling]**: Used to retrieve fresh Entra ID credentials.
- **[TA0010 - Exfiltration]**
- **[T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage]**: Stashing stolen files in calendar appointments.
- **[TA0005 - Defense Evasion]**
- **[T1070.006 - Indicator Removal: Timestomping]**: Scheduling events far in the future (year 2050) to avoid user/admin notice.
## Functionality
### Core Capabilities
- **Graph API Integration:** Uses the Microsoft Graph API to interact with M365 services, allowing the malware's traffic to blend in with legitimate office application traffic.
- **Calendar-Based C2:** Instead of a standard beacon, the malware "picks up" encrypted tasking from specific calendar events.
- **Future-Dated Stealth:** Commands and exfiltrated data are hidden in appointments set for May 13, 2050, ensuring they do not appear in the target user's immediate view or trigger alerts.
### Advanced Features
- **DNS Tunneling:** Maintains long-term access by retrieving fresh Entra ID (formerly Azure AD) authentication tokens via DNS queries, ensuring the Graph API connection remains active even if initial sessions expire.
- **Lean Architecture:** The malware is designed to be lightweight, focusing primarily on communication and data movement rather than self-contained heavy payloads.
## Indicators of Compromise
*Note: Specific hashes and domains were not provided in the source text; placeholders are used where behavioral indicators are confirmed.*
- **File Hashes:** [Not available in source]
- **File Names:** [Not available in source]
- **Registry Keys:** [Not available in source]
- **Network Indicators:**
- Consistent traffic to `graph[.]microsoft[.]com`
- Anomalous DNS query patterns (DNS Tunneling) directed at specific authoritative nameservers.
- **Behavioral Indicators:**
- Presence of calendar invitations/events scheduled for the year 2050.
- High volume of Microsoft Graph API requests originating from non-standard processes.
- Encrypted attachments (tasking/exfiltration) found within calendar items.
## Associated Threat Actors
- **Cavern Framework:** High confidence link due to matching command formats.
- **Lyceum (APT34-linked):** Low confidence link based on implementation similarities mentioned by researchers.
## Detection Methods
- **Behavioral Detection:** Monitor Microsoft 365 logs for unusual calendar activity, specifically the creation of events or attachments in the distant future.
- **Network Analysis:** Inspect DNS traffic for characteristic tunneling patterns (high frequency of subdomains, long/high-entropy strings in queries).
- **API Monitoring:** Audit Microsoft Graph API logs for high-frequency access to the `/me/events` or `/users/{id}/events` endpoints from suspicious internal endpoints.
## Mitigation Strategies
- **Least Privilege:** Restrict the ability of users to grant third-party application permissions within Entra ID.
- **Endpoint Security:** Deploy EDR solutions capable of detecting DNS tunneling and unusual API-calling behaviors from local processes.
- **Conditional Access:** Implement strict Conditional Access policies in M365 to limit from where and how the Graph API can be queried.
- **Log Review:** Periodically audit M365 mailboxes for "hidden" or future-dated calendar items via PowerShell/Microsoft Graph.
## Related Tools/Techniques
- **Cavern:** A broader attack framework that shares implementation details with HOLLOWGRAPH.
- **Graphican:** Other malware families known to leverage Microsoft Graph for C2 purposes.