🔴 Breaking

HollowGraph — espionage malware hides C2 in M365 calendar events dated 2050, all traffic through graph.microsoft.com, no attacker server, no patch, hunt events dated beyond 2030 now • wp2shell active exploitation confirmed, AI-built exploit chain published • GPT-5.5 92.4% offensive cyber tasks, benchmarks saturated • UEFI Secure Boot bypass — 11 Microsoft-signed shims • CitrixBleed 2 — 7 steps to DragonForce in under an hour HollowGraph — espionage malware hides C2 in M365 calendar events dated 2050, all traffic through graph.microsoft.com, no attacker server, no patch, hunt events dated beyond 2030 now • wp2shell active exploitation confirmed, AI-built exploit chain published • GPT-5.5 92.4% offensive cyber tasks, benchmarks saturated • UEFI Secure Boot bypass — 11 Microsoft-signed shims • CitrixBleed 2 — 7 steps to DragonForce in under an hour

HollowGraph malware Microsoft 365 calendar C2 Graph API Cavern espionage Group-IB 2026

Cover StoryNo Attacker ServerNo PatchLooks Like OutlookCavern FrameworkIranian-Nexus

HollowGraph: Espionage Malware Hides C2 in Microsoft 365 Calendar Events Dated 2050 — No Attacker Server, No Patch, Traffic Indistinguishable from Outlook

A .NET DLL implant uses a compromised M365 account’s calendar as a two-way dead drop. Commands buried in calendar events dated May 13, 2050. Stolen data attached to the same events. All traffic through graph.microsoft.com. No attacker-owned server. No unusual destination. No Microsoft vulnerability. No patch. Linked to Cavern C2 framework with high confidence. Seven detection steps inside — no signatures, only behavioral hunting.

Threat Intelligence · M365 SecurityJuly 20, 202615 min read

Read Full Brief →

Web Security · Active Exploitation Confirmed

wp2shell — Active Exploitation Confirmed, AI-Built Exploit Chain Published, Update Now

July 17, 2026 AI Security · Offensive Benchmark

GPT-5.5 Solved 92.4% of Offensive Cyber Tasks — Benchmarks Saturated, Doubles Every 6 Months

July 16, 2026 Firmware Security · Bootkit

UEFI Secure Boot Bypass — 11 Microsoft-Signed Shims, No Exploit Needed, Bootkits Before EDR

July 15, 2026 Network Security · Ransomware

CitrixBleed 2 — Seven Steps to DragonForce in Under an Hour, MFA Bypassed

July 13, 2026

Threat Briefs

Active Threats

CISA KEV Listed

No Patch Yet

Latest

Threats & Attacks

Threat Intelligence · M365 · No Patch · Cavern

HollowGraph: C2 Hidden in M365 Calendar Events Dated 2050 — No Attacker Server, Traffic Looks Like Outlook, No Patch

Commands in calendar events dated 2050. All traffic through graph.microsoft.com. No unusual destination. No Microsoft vulnerability. No patch. Linked to Cavern framework, Iranian-nexus Lyceum. Hunt events dated beyond 2030 now.

July 20, 2026→

Web Security · WordPress Core · Active Exploitation

wp2shell: Unauthenticated WordPress Core RCE — Active Exploitation Confirmed, AI-Built Exploit Chain

REST API batch endpoint. Single anonymous request. No preconditions. 500M+ sites. AI model built working exploit chain. Update to 7.0.2 / 6.9.5 immediately.

July 17, 2026→

AI Security · Offensive Benchmark

GPT-5.5 Solved 92.4% of Offensive Cyber Tasks and Broke the Benchmark — Doubles Every 6 Months

292/316 tasks. All 7 benchmarks saturated. 32-point gap from token budget. UK AISI confirmed. GPT-5.6 government-gated. Five operational implications.

July 16, 2026→

Firmware Security · No Exploit Needed

UEFI Secure Boot Bypass: 11 Microsoft-Signed Shims, No Exploit Needed, Bootkits Load Before EDR

Just a file copy. 11 shims trusted by every UEFI computer. BlackLotus, Bootkitty. Runs before OS, before EDR, survives OS reinstall. Apply June dbx update.

July 15, 2026→

Network Security · MFA Bypassed

CitrixBleed 2: Seven Steps From NetScaler Memory Leak to DragonForce Ransomware in Under an Hour

5,937 login failures = leaked heap memory. MFA bypassed. SYSTEM in minutes. Same playbook across 6 victims. Stolen tokens survive patching — kill all sessions.

July 13, 2026→

AI Security · First AI Agent Ransomware

JADEPUFFER: First Confirmed AI Agent Ransomware — 600 Payloads, Recovery Impossible, Cost Near Zero

Autonomous LLM: initial access to encryption to ransom demand. Ran on victim’s stolen API keys. Same pattern as HollowGraph — legitimate cloud infrastructure as operational terrain.

July 9, 2026→

Analysis