Group-IB finds malware using Microsoft 365 calendars for espionage

Group-IB says it has identified an espionage malware component, HOLLOWGRAPH, that uses compromised Microsoft 365 calendars as its command-and-control channel. The finding matters for enterprise security teams because the malware is not abusing a Microsoft 365 vulnerability; it is operating through Microsoft Graph API activity that can resemble normal cloud application traffic.

According to Group-IB, HOLLOWGRAPH stores encrypted operator instructions and exfiltrated files inside calendar events rather than contacting attacker-owned infrastructure in the usual way. The researchers said each event created by the malware is dated May 13, 2050, putting the activity in a part of the calendar where attachments and unusual entries are less likely to be noticed by users or administrators.

The technique turns a trusted SaaS workflow into a drop box. Group-IB said the implant reads one calendar appointment to retrieve tasking, then creates another appointment to hold stolen files for later collection. The communications are wrapped in legitimate Microsoft Graph API requests, making them harder to separate from routine Microsoft 365 traffic at the network perimeter.

A small implant built around trusted cloud access

Group-IB described HOLLOWGRAPH as a relatively limited malware component. Its main functions are to collect instructions from a calendar event, place stolen files in another event, and refresh Entra ID credentials through a DNS tunneling channel so access to Microsoft Graph continues to work.

That design is less about feature breadth than operational cover. By using a compromised Microsoft 365 mailbox and valid cloud authentication, the operators can avoid some of the indicators defenders often rely on, such as malware beaconing to suspicious domains or IP addresses controlled by the attackers.

Group-IB linked HOLLOWGRAPH to the Cavern framework with high confidence, citing matching command formats and other implementation details. The company also reported similarities with Lyceum, an espionage group associated with Iran, but assigned that connection only low confidence. It did not make a firm attribution to Lyceum.

In its report, Group-IB called HOLLOWGRAPH an “advanced and highly targeted espionage threat,” saying its use of Microsoft 365 calendars, Microsoft Graph API traffic and DNS-based credential refreshes helps it avoid conventional perimeter defenses.

A narrow campaign, based on observed infections

The campaign appears limited in scope from the data Group-IB disclosed. The company said it found 12 infected systems, and only three of them communicated with the compromised mailbox during the period researchers observed.

Group-IB said the mailbox used for command-and-control belonged to an Israeli organization. It also said malware samples were uploaded from Israel. Based on those details, the researchers assessed the activity as a focused espionage operation rather than a broad criminal campaign.

Microsoft 365 and Microsoft Graph were not described as compromised through a product flaw. The reported technique relies on attacker access to trusted cloud services and credentials, which puts detection pressure on identity monitoring, mailbox auditing and anomalous Graph API usage rather than patch management alone.

For security teams, the non-obvious issue is where command-and-control can now live. Calendar entries, attachments and API calls are ordinary parts of Microsoft 365 operations. Group-IB’s findings show how espionage operators can use that ordinariness as infrastructure when they already have a foothold in a cloud tenant.

This story draws on original reporting from The Register.