HollowGraph: Espionage Malware Hides C2 in Microsoft 365 Calendar Events Dated 2050 — No Attacker Server, No Patch, Traffic Indistinguishable from Outlook

Sources: Group-IB Threat Intelligence — primary research report “HollowGraph: Microsoft 365 Calendars as Command-and-Control Infrastructure” (July 20, 2026) · The Hacker News — “HollowGraph Malware Hides C2 and Stolen Files in Microsoft 365 Events Dated 2050” · Bleeping Computer — “New HollowGraph Malware Uses Microsoft Graph for Stealthy C2 Comms” · Infosecurity Magazine — “New HollowGraph Malware Hijacks Microsoft 365 Calendars for Covert C2” · The Register — “Microsoft 365 Calendars Become Spy Drop Boxes in HOLLOWGRAPH Campaign” · SC Media · Windows News | Malware name: HollowGraph (HOLLOWGRAPH) | Framework: Cavern C2 (high-confidence link) | Threat actor: Unknown — technical similarities with Iranian-nexus Lyceum (low confidence) | Discovered by: Group-IB Threat Intelligence | Observation window: June 3 – July 9, 2026 | Report published: July 20, 2026 | Infected systems identified: 12 (3 active during observation) | Targeting: Israeli entities — highly targeted espionage, not opportunistic | Microsoft vulnerability: None — rides legitimate Graph API functionality via a compromised account | Patch available: No — detection and identity controls are the only remediation | IOC domain: cloudlanecdn[.]com | IOC file: logAzure.txt | C2 date trick: Calendar events dated May 13, 2050

Group-IB’s framing of what makes HollowGraph significant: “By abusing trusted Microsoft 365 calendars through the Microsoft Graph API and refreshing its cloud authentication credentials through DNS tunneling, the malware conceals its command-and-control within legitimate Microsoft 365 and network traffic, evading conventional perimeter defenses.” The technique of using legitimate cloud services as C2 infrastructure is not new — attackers have previously abused Google Drive, Dropbox, and even social media platforms for similar ends. HollowGraph extends this to a business-critical platform — Microsoft 365 — and to a feature that is mundane, universally present, and almost never inspected by security teams: the calendar. The future-dating trick is straightforward concealment. The integration of DNS tunneling for credential refresh marks a meaningful evolution in the resilience of the channel.

There is no Microsoft vulnerability in HollowGraph and no patch to deploy. HollowGraph rides a compromised account and the Graph API’s normal functionality, which is exactly why it is hard to spot. The work is on identity and application permissions plus monitoring, not a patch. Every organization running Microsoft 365 — which is the majority of enterprise organizations globally — is potentially exposed to this technique. Detection requires hunting in places that most security teams are not currently looking: calendar metadata, OAuth application permissions, and DNS tunneling patterns.

The C2 architecture — how a calendar becomes a dead drop

HollowGraph’s C2 design inverts the standard attacker-infrastructure model. In conventional malware, the infected endpoint reaches out to an attacker-controlled server — a domain, an IP address, a hosting provider — to receive instructions and deliver stolen data. That outbound connection to an attacker-owned destination is the detection signal that network monitoring, threat intelligence feeds, and DNS sinkholes are designed to catch. HollowGraph eliminates this signal entirely by replacing the attacker-owned server with a compromised Microsoft 365 account.

The implant is a .NET DLL that supports just two commands, get and send, and it never reaches out to an attacker-owned server for payloads. Instead, it treats the compromised mailbox’s calendar as a two-way dead drop. The GET command retrieves attacker instructions from files attached to the far-future calendar events. The SEND command uploads stolen data as attachments to those same events. All traffic flows through Microsoft’s Graph API — the same API that Outlook, Teams, and every Microsoft 365 integration uses for legitimate calendar synchronization. The network signature of an HollowGraph-infected endpoint is identical to the network signature of any other Microsoft 365 user syncing their Outlook calendar.

The specific concealment detail — calendar events dated May 13, 2050 — is precisely chosen. Group-IB has uncovered a targeted malware campaign, dubbed HOLLOWGRAPH, that uses compromised Microsoft 365 calendars as a stealthy command-and-control channel, burying encrypted tasking in appointments dated May 13, 2050. A calendar event 24 years in the future is invisible in any normal calendar view. No user will scroll to 2050 in their Outlook calendar. No SOC analyst casually reviewing M365 audit logs will notice a calendar event that far out. The only way to find it is to specifically query for events beyond a threshold date — which is exactly the detection technique Group-IB recommends.

The DNS tunneling channel — credential refresh that doesn’t touch Graph

HollowGraph’s second channel is the architectural detail that makes the C2 resilient rather than merely stealthy. HollowGraph also uses DNS tunneling to deliver and refresh Microsoft Entra ID (Azure AD) credentials needed to authenticate to the Graph channel. DNS tunneling encodes data inside DNS query and response strings — it uses the DNS protocol, which is universally allowed outbound from enterprise networks, as a covert data channel.

The operational purpose of this second channel is credential resilience. If the compromised M365 account’s credentials are rotated — either by the victim organization during incident response or by expiry — the attacker can push updated Entra ID credentials to the implant through the DNS channel without any Graph API interaction. The implant receives the new credentials via DNS tunneling, updates its logAzure.txt configuration file, and resumes Graph API communication with the new credentials. This means that credential rotation alone does not sever the C2 channel — the attacker can re-establish it as long as DNS tunneling to the attacker’s domain (cloudlanecdn[.]com) is possible.

The encryption scheme applied to the Graph channel — a hybrid scheme combining RSA and AES-256-GCM, with distinct RSA key pairs used for each direction (inbound vs. outbound) — ensures that even if an organization intercepts and inspects the calendar event attachments, they cannot read the contents without the corresponding private keys. The combination of legitimate-service C2, far-future calendar concealment, DNS-tunneled credential refresh, and strong asymmetric encryption produces a C2 architecture that is simultaneously stealthy, resilient, and forensically difficult to reconstruct.

The Cavern framework link — and what it means for the broader threat landscape

Group-IB assesses with high confidence that HollowGraph is a component of the Cavern command-and-control framework. The specific technical evidence: the component is invoked with the string format _;;__,__,_, which matches Cavern’s command syntax. Cavern has been previously linked to Iranian-nexus threat activity, and Group-IB identifies technical similarities with the Iranian-nexus espionage actor Lyceum — though this attribution carries only low confidence and Group-IB stops well short of definitively attributing HollowGraph to Lyceum or any named Iranian group.

The attribution question matters less than the technique question. Group-IB reads that small, selective footprint as targeted espionage rather than opportunistic crime, even though the technique behind it could be reused far more widely than this one campaign. This is the operationally important caveat: HollowGraph’s Calendar-as-C2 technique is not inherently limited to the specific threat actor or the specific targeting of Israeli entities that Group-IB observed. The Microsoft Graph API is available to any authenticated application. Any attacker who can compromise an M365 account — through credential theft, phishing, device code phishing, or any of the identity-bypass techniques DataWater has covered all year — can deploy this C2 technique against any organization running Microsoft 365. The targeting scope of the observed campaign is narrow. The reusability of the technique is universal.

Why conventional defenses fail against this architecture

HollowGraph defeats the four conventional defensive layers that enterprise security architecture relies on for C2 detection and blocking:

• Threat intelligence feed blocking — blind. Threat intelligence feeds block known-malicious domains, IPs, and certificates. HollowGraph’s C2 traffic reaches microsoft.com — specifically graph.microsoft.com. Blocking Microsoft’s Graph API endpoint would disable every Microsoft 365 application in the organization.
• Network traffic inspection — blind. TLS inspection decrypts and inspects outbound HTTPS traffic to detect malicious payloads. HollowGraph’s traffic is encrypted at the application layer (RSA + AES-256-GCM) before it reaches the TLS layer, and the destination (graph.microsoft.com) is a legitimate Microsoft endpoint that most organizations explicitly exempt from deep inspection to avoid breaking legitimate M365 functionality.
• Data Loss Prevention — partially blind. DLP tools inspect outbound traffic for sensitive data patterns. HollowGraph encrypts exfiltrated data before attaching it to calendar events — the DLP tool sees encrypted bytes going to a Microsoft endpoint, not recognizable sensitive content going to an attacker.
• EDR behavioral detection — the primary viable detection layer. EDR tools monitoring process behavior on the endpoint may detect the DLL injection or unusual process activity associated with HollowGraph’s execution. This is the most viable detection path — but it requires EDR rules specifically tuned for .NET DLL execution patterns and unusual Graph API authentication activity from non-standard processes.

Detection — what to hunt for right now

Group-IB’s detection guidance focuses on the malware’s own operational habits — the signals it cannot avoid producing:

1. Hunt calendar events dated beyond 2030 across your tenant. Use the Microsoft Graph API or Microsoft 365 Compliance Center to query for calendar events with start dates in the far future. Any event dated to 2050 or beyond is highly anomalous. Query: GET /users/{id}/calendar/events?$filter=start/dateTime ge '2049-01-01' via Graph API, or use the Microsoft 365 eDiscovery content search with a date filter.
2. Alert on newly created client credential OAuth applications in Entra ID. HollowGraph authenticates via hardcoded client credentials — a registered application with a client secret, not a user-delegated token. Monitor Azure AD audit logs for new app registrations (AuditLogs with operation “Add application”) and new client secrets on existing apps (operation “Add service principal credentials”).
3. Audit all OAuth apps with Calendar.ReadWrite or Calendar.Read scope. Navigate to Entra ID → Enterprise Applications → filter by “Application permissions” → identify all apps with calendar-related permissions. Any app with write access to calendars that is not on your known-good list (typically only Exchange/Outlook integration apps) should be investigated.
4. Monitor outbound DNS for tunneling patterns. HollowGraph uses DNS tunneling for Entra ID credential refresh. Indicators of DNS tunneling include: unusually high volume of DNS queries to a single domain, queries with very long subdomain strings (encoded data), and DNS query/response timing patterns inconsistent with normal browsing.
5. Search endpoints for logAzure.txt. HollowGraph stores its configuration — tenant IDs, client secrets, encryption keys — in a file with this name. An EDR file search or threat hunting query across the fleet for this filename will identify infected systems.
6. Block cloudlanecdn[.]com at DNS and network perimeter. This is the DNS tunneling domain Group-IB identified. Add to DNS blocklists immediately.
7. Review M365 audit logs for application-driven calendar writes. In the Microsoft 365 Compliance Center → Audit → search for CalendarItemCreate or CalendarItemModify events where ClientAppId is not a known legitimate application. Application-driven calendar writes at unusual times or with unusual event subjects are the direct signature of HollowGraph’s C2 writes.

The broader pattern: cloud infrastructure as attacker terrain

HollowGraph is the latest and most sophisticated implementation of a pattern that DataWater has tracked throughout 2026: attackers using legitimate cloud infrastructure as operational terrain rather than building attacker-owned infrastructure that can be detected and blocked. The pattern runs through all of DataWater’s major 2026 stories:

• The Claude Code reverse shell used a DNS TXT record on legitimate DNS infrastructure — the payload never existed in any source that security tools inspect
• JADEPUFFER used OpenAI, Anthropic, and Gemini API infrastructure — the AI that ran the attack was hosted on legitimate AI provider compute
• Device code phishing exploited Microsoft’s own OAuth device authorization flow — the phishing traffic flows through Microsoft’s authentication infrastructure
• HollowGraph uses Microsoft 365 calendar and Microsoft Graph API — the C2 traffic is Microsoft’s own infrastructure

The common thread: by operating through legitimate cloud services, attackers eliminate the attacker-owned-infrastructure detection signal that conventional security tools depend on. The response required is not better blocklists or better TLS inspection — it is behavioral analytics on legitimate cloud service usage, OAuth application governance, and identity posture management. Security teams log 54% of successful attacks and alert on just 14%. HollowGraph is specifically designed to be in the 86% that doesn’t generate alerts.

Sources and further reading

• The Hacker News — HollowGraph Malware Hides C2 and Stolen Files in Microsoft 365 Events Dated 2050 (Primary Summary)
• Bleeping Computer — New HollowGraph Malware Uses Microsoft Graph for Stealthy C2 Comms
• Infosecurity Magazine — New HollowGraph Malware Hijacks Microsoft 365 Calendars for Covert C2
• The Register — Microsoft 365 Calendars Become Spy Drop Boxes in HOLLOWGRAPH Campaign
• SC Media — HollowGraph Malware Uses Microsoft 365 Calendar for Command and Control

DataWater publishes daily cybersecurity intelligence for enterprise and government security leaders. Article #45 — July 20, 2026. Previous: wp2shell — Unauthenticated WordPress Core RCE (July 17) · GPT-5.5 Offensive Cyber Benchmark (July 16) · UEFI Secure Boot Bypass (July 15). Browse the full threat brief archive →