HOLLOWGRAPH is a .NET espionage implant that turns a compromised Microsoft 365 mailbox calendar into a covert two-way command-and-control channel, using the trusted Microsoft Graph API to plant tasking and exfiltrate stolen files as encrypted, far-future calendar events.
HOLLOWGRAPH is a .NET espionage implant, first seen on June 3, 2026, that turns a compromised Microsoft 365 mailbox calendar into a covert two-way command-and-control channel. Working through the trusted Microsoft Graph API, HOLLOWGRAPH operators plant tasking as calendar events, and the implant exfiltrates stolen files as encrypted attachments on events it creates, all dated far into the future (May 13, 2050) so the mailbox owner never notices them.
HOLLOWGRAPH payloads are protected with hybrid RSA and AES-256 encryption, using separate key pairs for incoming and outgoing traffic. A second channel uses DNS tunneling over IPv6 AAAA records to the attacker domain cloudlanecdn[.]com to refresh the Entra ID credentials the malware authenticates with. At least 12 infected systems tied to the HOLLOWGRAPH campaign are identified, roughly three actively communicating during analysis, with all evidence pointing to a narrow, targeted focus on Israeli entities.
#1 Hiding in Plain Sight Inside Microsoft's Own Cloud
HOLLOWGRAPH is espionage malware that stands out less for what it steals and more for where it hides. Instead of talking to a server the attacker owns, it borrows Microsoft's own cloud: every command it receives and every file it steals moves through normal-looking Microsoft 365 traffic, which makes the HOLLOWGRAPH activity extremely hard to separate from an organization's everyday cloud usage. Group-IB links the implant with high confidence to the modular Cavern backdoor framework, a toolset previously tied to Iranian-nexus activity.
#2 Operating Through an Already Compromised Microsoft 365 Account
The HOLLOWGRAPH malware does not need to break in on its own. It operates through an already compromised Microsoft 365 account belonging to an Israeli organization, using stored Microsoft Entra ID (Azure AD) credentials, tenant ID, client ID, client secret, and the target mailbox to authenticate with the Microsoft Graph API. How that account and the affected hosts were first compromised is not detailed in the available reporting.
#3 A NativeAOT-Compiled DLL Blending in With Log Files
Technically, HOLLOWGRAPH is a .NET NativeAOT-compiled DLL that a loader runs with a structured command string. It supports only two actions, "get" and "send," and both run entirely through the Graph API. On execution, HOLLOWGRAPH writes its hardcoded configuration to disk as logAzure.txt, a filename chosen to blend in with ordinary log files.
#4 A Shared Calendar as a Covert Drop Box
The clever part is the calendar. The compromised mailbox's calendar acts as a shared drop box. To pick up orders, HOLLOWGRAPH runs the "get" command, searching for an operator-planted event scheduled for May 13, 2050, and titled "Event ID: <task ID>," then downloads and decrypts the attached instructions with its private RSA key. To steal data, the "send" command reverses the flow: it encrypts the target file, creates its own far-future 2050 event, uploads the data as one or more "File{n}.txt" attachments, and renames the event to an operator-recognizable "Boss{..}ID{..}" tag. All of this is secured with hybrid RSA-OAEP plus AES-256-GCM, using distinct key pairs so that tasking and exfiltration remain cryptographically separate.
#5 A Separate DNS Channel Keeps Access Alive
Because both tasking and exfiltration ride the same trusted Graph channel, the stolen data leaves the environment disguised as routine Microsoft 365 calendar activity rather than as recognizable outbound C2. A separate, unencrypted DNS channel keeps that access alive: HOLLOWGRAPH issues AAAA (IPv6) queries to cloudlanecdn[.]com, decodes the credential values from the returned IPv6 addresses in 14-byte chunks, and rewrites the refreshed values back into logAzure.txt. Notably, there is no Microsoft vulnerability and no patch involved here — HOLLOWGRAPH abuses a compromised account and the Graph API's legitimate functionality, which is exactly what makes it stealthy.
