Hiding in Plain Sight Inside Outlook

Researchers at Group-IB have uncovered a new malware component, dubbed HOLLOWGRAPH, that turns a compromised Microsoft 365 mailbox’s calendar into a covert communication channel between hackers and infected machines. Rather than reaching out to a suspicious external server — the kind of behavior that tends to trip network alarms — HOLLOWGRAPH routes everything through Microsoft’s own trusted cloud infrastructure via the Microsoft Graph API, letting malicious traffic hide among a company’s ordinary business activity.

The .NET-compiled tool is deliberately minimal. It understands only two commands, “get” and “send,” and uses the calendar of a compromised Microsoft 365 account as what Group-IB describes as a two-way “dead drop.” Operators plant instructions inside calendar events, and the malware responds by creating its own encrypted events on the same calendar, hiding stolen data inside file attachments rather than the event body.

The 2050 Trick

To keep the compromised mailbox’s actual owner from noticing anything unusual, every malicious calendar entry is dated 24 years in the future — specifically May 13, 2050. Since that date will never appear on anyone’s actual day-to-day schedule, the entries sit invisibly in the calendar’s back catalog, effectively creating a hidden storage area inside a tool everyone already trusts.

HOLLOWGRAPH backs this up with a second covert channel for refreshing its own access. It uses DNS tunneling through IPv6 AAAA record lookups to a domain identified as cloudlanecdn[.]com to quietly renew its Microsoft Entra ID login credentials, then stores the refreshed values inside a file disguised as an ordinary log — logAzure.txt. Every piece of data moving through the Graph API channel is encrypted using a hybrid RSA and AES-256-GCM scheme, with separate key pairs securing inbound commands and outbound stolen data so the two directions can’t be cross-referenced even if one key is compromised.

Possible Ties to an Iran-Nexus Group

Group-IB attributes HOLLOWGRAPH with high confidence to the Cavern backdoor framework, a modular command-and-control toolkit previously documented by Check Point Research and linked to an Iran-nexus actor known as Cavern Manticore. The attribution rests on matching command syntax and shared internal command codes found across both malware families.

Investigators also noted technical overlap — held at only low confidence — with Lyceum, an Iranian threat group tied to Iran’s Ministry of Intelligence and Security and considered a sub-cluster of the OilRig umbrella. Whatever the precise lineage, the operation appears narrowly targeted rather than opportunistic: every indicator, from the single compromised mailbox to the uploaded malware samples and related Cavern artifacts, points toward a focus on Israeli organizations, consistent with an espionage-driven campaign rather than mass-scale cybercrime.

Notably, this is a small, surgical operation. Group-IB identified only 12 infected systems total, with roughly three still actively communicating with their operators during the observation window. Activity has been tracked since at least June 3, 2026, with the most recent confirmed communication logged on July 9, 2026.

How Defenders Can Hunt for It

Because HOLLOWGRAPH hides inside a legitimate, heavily-trusted service, traditional network monitoring is unlikely to catch it. Group-IB recommends security teams look specifically for:

• Calendar events dated 2050-05-13, an implausible far-future date that shouldn’t appear in normal usage
• Event subjects that are bare GUIDs or follow patterns like “Event ID:” or “Boss{..}ID{..}”
• Attachments named using a File{n}.txt convention
• Unusual AAAA DNS record queries, particularly toward cloudlanecdn[.]com
• The presence of a file named logAzure.txt masquerading as a routine log

Beyond specific indicators, Group-IB urges organizations to audit Microsoft Graph API activity for application-driven calendar changes, tighten controls around OAuth application permissions, and strengthen monitoring of Entra ID credential usage. As attackers increasingly favor trusted cloud platforms over dedicated infrastructure for command and control, that kind of visibility into normal cloud service behavior is becoming essential rather than optional.