Malware Turns Microsoft 365 Calendar Into Covert Attack Vector
Security researchers at Group-IB have uncovered a Windows malware strain that turns Microsoft 365 calendars into covert channels for receiving commands and stealing files from targeted organizations. The malware component, dubbed HOLLOWGRAPH, abuses the Microsoft Graph API and a compromised Microsoft 365 account to conceal command-and-control activity within legitimate cloud communications.
The malware uses the compromised account's calendar as what Group-IB called a "two-way dead drop." Attackers create calendar events containing encrypted instructions while HOLLOWGRAPH uploads stolen files as attachments to separate events.
Those events are scheduled for May 13, 2050, keeping them far outside the mailbox owner's normal calendar view. The approach allows the malware to communicate through Microsoft infrastructure without connecting directly to an attacker-controlled server for its primary command channel.
HOLLOWGRAPH supports only two commands: "get" for retrieving instructions and "send" for exfiltrating files. The limited command set suggests the malware operates as one part of a larger collection of tools rather than as a standalone backdoor.
Group-IB linked the malware with high confidence to the Cavern backdoor framework based on similarities in command syntax and architecture. The firm found at least 12 infected systems, though only three were actively communicating with the attacker during the observation period.
The earliest communication occurred June 3 and the latest was recorded July 9. A compromised mailbox tied to an Israeli organization and malware samples uploaded from Israel indicate that the campaign has focused primarily on Israeli targets.
The small number of infections suggests the operation is "highly targeted rather than opportunistic," Group-IB said.
HOLLOWGRAPH also maintains a secondary communication method using Domain Name System tunneling. The malware sends specially constructed IPv6 address queries to an attacker-controlled domain to obtain updated Microsoft Entra ID credentials, including the tenant ID, client ID, client secret, and mailbox address needed to access Microsoft Graph.
Commands and stolen data sent through the calendar are protected with RSA and AES encryption. Separate key pairs handle incoming instructions and outgoing files, preventing exposure of one key from immediately compromising both communication directions.
Group-IB said it could not confidently attribute the campaign to a known threat actor. Researchers found some technical overlap with Lyceum, an Iranian-linked subgroup of OilRig, but assessed that connection with low confidence. The targeting and technical design nevertheless point to a "capable and well-resourced adversary," the firm said.
The campaign extends a broader trend in which attackers hide malicious activity behind trusted services and familiar business tools. Recent malware operations have abused signed applications, remote management software, and cloud infrastructure to blend into legitimate enterprise activity.
Group-IB recommends that security teams monitor Microsoft Graph and mailbox audit logs for unusual calendar operations, particularly events dated far into the future. Defenders should also look for events with encrypted text attachments, application-generated subject changes, and the logAzure.txt configuration file.
Orgs should audit OAuth applications, rotate exposed credentials and watch for unusually frequent IPv6 DNS queries or long, high-entropy subdomains that could indicate tunneling activity. For more information, check out Group-IB's full technical analysis here.