HOLLOWGRAPH: Turning Microsoft 365 Calendars into Covert Command-and-Control Channels

This malware campaign leverages Microsoft Graph API abuse to transform Microsoft 365 calendars into covert C2 infrastructure by creating future-dated calendar events containing encrypted attachments for data exfiltration and command reception. It employs a secondary DNS tunneling channel using IPv6 AAAA records to refresh authentication credentials (Microsoft Entra ID). Communications are protected by hybrid RSA and AES-256-GCM encryption with distinct key pairs for inbound and outbound channels. The campaign targets primarily Israeli entities, with twelve infected hosts identified and three actively communicating. The adversary LYCEUM is suspected, indicating a well-resourced espionage operation with disciplined targeting and advanced technical methods.

The malware enables attackers to covertly exfiltrate sensitive data and issue commands through Microsoft 365 calendar events, bypassing traditional network monitoring. The use of encrypted attachments and DNS tunneling for credential refresh enhances stealth and persistence. This compromises confidentiality and potentially integrity of targeted systems. The focused targeting of Israeli entities suggests espionage motives. No widespread exploitation or known public exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Organizations should monitor for suspicious calendar events, especially those dated far in the future with encrypted attachments, and investigate unusual DNS AAAA record queries. Review and restrict Microsoft Graph API permissions to the minimum necessary. Employ anomaly detection for calendar and DNS activity. Follow updates from Microsoft and security vendors for official fixes or mitigations.