Malicious Malware Uses Microsoft Graph to Conceal Stealthy Communication with Attackers
A newly discovered malware component, dubbed HollowGraph, has been found using compromised Microsoft 365 mailboxes as a command-and-control channel to receive attacker commands and exfiltrate stolen data. This sophisticated tool is part of the Cavern command-and-control framework, which has been previously linked to an Iranian threat actor targeting entities in Israel.
According to researchers at Group-IB, HollowGraph uses hardcoded details to authenticate to the Microsoft Graph API via a compromised Microsoft 365 account. The malware’s configuration file, stored as logAzure.txt, contains sensitive information such as Microsoft Entra ID tenant IDs, application IDs, client secrets, and target mailbox addresses. This level of access allows the attackers to remain stealthy and conceal their communication with the malware.
To further evade detection, HollowGraph creates calendar events dated May 13, 2050, with specific titles that contain commands or exfiltrated data in encrypted form. These files are attached to the calendar entries, making it challenging for security teams to identify suspicious activity within the mailbox. The researchers describe this tactic as a “covert dead-drop,” where HollowGraph retrieves commands from events scheduled within a fixed one-hour window between 22:00 and 23:00 UTC on May 13, 2050.
Group-IB’s analysis reveals that HollowGraph supports only two commands, GET and SEND. The GET command allows the malware to search for existing calendar entries with specific task IDs and download instructions from the attacker. The SEND command enables the creation of new calendar entries containing stolen data in encrypted form.
The researchers have also discovered a second communication channel used by HollowGraph through DNS tunneling. This unencrypted channel is used to receive new Microsoft Entra ID details, which are then updated in the configuration files stored as logAzure.txt. The attackers use this hybrid encryption scheme to secure their communication over Microsoft Graph, separating inbound and outbound channels cryptographically.
“HOLLOWGRAPH demonstrates a high level of technical sophistication,” Group-IB concludes. “Its use of trusted cloud infrastructure for command-and-control, hybrid encryption, DNS tunneling for credential refresh, and highly selective victim targeting collectively suggest that the threat actor possesses significant technical capabilities and operational maturity.”
While researchers cannot attribute HollowGraph to a known threat actor with high confidence, they have identified several technical similarities with the Iranian-nexus threat actor Lyceum. However, Group-IB’s analysis confirms a link between HollowGraph and the Cavern framework.
To mitigate this threat, organizations are advised to monitor Microsoft Graph and Microsoft 365 audit logs for suspicious application-driven calendar activity, particularly events in the far future, and unusual subjects and attachments. They should also look for indicators such as the ‘cloudlanecdn[.]com’ domain and the ‘logAzure.txt’ file, enforce Conditional Access, restrict and audit OAuth client-credential applications, and monitor outbound DNS for tunneling patterns.
As security teams continue to struggle with detecting attacks in real-time, it is essential to implement a robust defense strategy that includes monitoring all layers of an organization’s environment. By doing so, we can reduce the likelihood of successful attacks and prevent attackers from moving through our systems unseen.
Source: Bleeping Computer — 2026-07-20