Microsoft 365 calendars become spy drop boxes in HOLLOWGRAPH campaign

Microsoft 365 calendars have become the latest hiding place for espionage malware, with attackers stashing commands and stolen files inside appointments dated 24 years into the future. Researchers at Group-IB say they've uncovered a malware component they call HOLLOWGRAPH that swaps the usual command-and-control server for something rather less conspicuous - a compromised Microsoft 365 calendar. Instead of reaching out to attacker-controlled infrastructure for instructions, the implant rummages through calendar events, picks up encrypted tasking, and drops stolen files into new appointments for its operators to collect later. Every event created by HOLLOWGRAPH is dated May 13, 2050, an otherwise empty corner of the diary where encrypted attachments are less likely to attract attention. HOLLOWGRAPH isn't exploiting Microsoft Graph so much as blending into it, wrapping its command-and-control traffic inside legitimate Graph API requests that look just like any other Microsoft 365 application talking to the cloud. The malware itself is relatively lean. Group-IB says it does little more than fetch instructions from one calendar event, stash stolen files in another, and periodically retrieve fresh Entra ID credentials over a DNS tunneling channel so the Graph-based communications keep working. The security firm linked the malware to the Cavern framework with high confidence after finding matching command formats and other implementation details. It also spotted similarities with the Iranian-linked espionage group Lyceum, although it stopped well short of pinning the operation on that crew, saying the connection was supported with only low confidence. "HOLLOWGRAPH represents an advanced and highly targeted espionage threat," Group-IB wrote. "By abusing trusted Microsoft 365 calendars through the Microsoft Graph API and refreshing its cloud authentication credentials through DNS tunneling, the malware conceals its command-and-control within legitimate Microsoft 365 and network traffic, evading conventional perimeter defenses." The campaign itself appears to be narrowly targeted. Group-IB identified 12 infected systems, only three of which communicated with the compromised mailbox during the period it observed. The compromised mailbox used for command-and-control belonged to an Israeli organization, malware samples were uploaded from Israel, and the researchers said the evidence points to a focused espionage operation rather than a broad smash-and-grab. HOLLOWGRAPH doesn't exploit a flaw in Microsoft 365 or Microsoft Graph. Instead, it takes advantage of services that are already trusted inside most organizations, making the activity far less conspicuous than malware calling home to attacker-controlled infrastructure. (R)