Ethical Hacking News
Recent news reports have revealed the existence of a highly sophisticated malware known as HollowGraph, which has been hiding malicious commands and stolen files within Microsoft 365 events dated back to 2050. In this article, we delve into the details of this complex threat, exploring its modus operandi, detection methods, and implications for security professionals. Learn how to stay ahead of such threats and protect your organization from sophisticated attacks like HollowGraph.
HollowGraph is a .NET DLL-based malware using hijacked Microsoft 365 calendar events as its command channel. The malware uses legitimate Microsoft Graph API traffic to evade detection and retrieves instructions from an attached file dated 2050-05-13. The malware has two commands (get and send) that are executed through a two-way dead drop using the compromised mailbox's calendar. Group-IB attributes HollowGraph to Cavern with high confidence, but cannot confidently attribute it to a previously identified threat actor due to lack of evidence. The malware has been found on at least 12 machines, with only three actively communicating with the attacker during analysis. Security professionals need to monitor events with specific characteristics, such as far-future dates and attachments named File{n}.txt. Recommendations include restricting client-credential OAuth apps, auditing Microsoft Graph activity, and implementing Entra ID hygiene measures.
THN has recently reported on a sophisticated piece of malware known as HollowGraph, which has been discovered to be hiding malicious commands and stolen files within Microsoft 365 events dated back to 2050. In this article, we will delve into the details of this complex threat, exploring its modus operandi, detection methods, and implications for security professionals.
HollowGraph is a .NET DLL-based malware that leverages hijacked Microsoft 365 calendar events as its command channel. This clever tactic allows the attackers to plant operator instructions and smuggle out stolen files within ordinary-looking calendar events. The malware supports only two commands, get and send, and it never reaches out to an attacker-owned server for payloads. Instead, it utilizes the compromised mailbox's calendar as a two-way dead drop.
The implant is particularly adept at evading detection due to its reliance on legitimate Microsoft Graph API traffic. This means that network controls keyed to attacker-owned destinations have nothing to flag. Furthermore, HollowGraph reads its instructions from an attached file buried within an event dated 2050-05-13, which makes it unlikely for the mailbox owner to ever scroll to this event.
In addition to the calendar-based command channel, the malware also uses a secondary, cruder channel to keep its Graph access alive. This channel refreshes the app's Entra ID (Azure AD) login details using DNS queries, decoding those values from IPv6 AAAA records sent back by an attacker domain. These decoded values are then written to a log file called logAzure.txt.
Group-IB has ties HollowGraph to Cavern with high confidence, based on shared command syntax and matching internal tasking. However, the firm is unable to confidently attribute this activity to any previously identified threat actor due to lack of evidence. The compromised exfiltration mailbox belongs to an Israeli organization, but Group-IB treats that as victim geography, not attribution.
HollowGraph has been found on at least 12 machines, with only three of them actively talking to the attacker during analysis. The firm reads this small footprint as targeted espionage rather than opportunistic crime, even though the technique behind it could be reused far more widely than this one campaign.
It is worth noting that there is no Microsoft software vulnerability involved in this attack, and therefore, no patch needs to be deployed. HollowGraph relies on a compromised account and the Graph API's normal functionality to carry out its malicious activities. As such, the work lies in identity and application permissions plus monitoring, not a patch.
In order to detect HollowGraph, security professionals need to hunt for events that carry certain specific characteristics. These include far-future dates specifically 2050-05-13, subjects matching the operator's Event ID or naming conventions, and attachments named File{n}.txt.
On the identity side, Group-IB recommends restricting and auditing client-credential OAuth apps that can reach Graph and alerting on newly created client secrets. Additionally, Entra ID hygiene measures such as Conditional Access, credential rotation, and anomalous-token detection should be implemented.
For detection, security teams need to audit Microsoft Graph and mailbox activity for application-driven calendar changes: events created, attachments uploaded, or subjects renamed by an app rather than a person. Watching DNS queries too can help identify unusually frequent AAAA queries and long, high-entropy subdomains aimed at a single domain. Specifically, hunting for cloudlanecdn[.]com and the logAzure.txt config file is essential.
The article concludes that hiding command-and-control in trusted Microsoft services is not new, as attackers have already exploited Outlook inboxes, draft folders, and OneDrive in previous campaigns. The fact that events parked in 2050 are simply a recent spot where defenders had no reason to inspect further underscores the complexity of this threat.
The discovery of HollowGraph serves as a reminder of the importance of vigilance and proactive security measures. While the operator behind this campaign remains unknown, it is clear that sophisticated threats like HollowGraph will continue to pose significant challenges to security professionals in the years to come.
Related Information:
https://www.ethicalhackingnews.com/articles/The-Insidious-Shadow-of-HollowGraph-Unveiling-the-Sophisticated-Malware-Hiding-in-Plain-Sight-ehn.shtml
https://thehackernews.com/2026/07/hollowgraph-malware-hides-c2-and-stolen.html
Published: Mon Jul 20 10:58:55 2026 by llama3.2 3B Q4_K_M
