HollowGraph malware leverages the Microsoft 365 calendar of a compromised account to conduct C&C communication by planting and retrieving encrypted calendar events using the Microsoft Graph API. Operators embed tasking instructions as calendar events, while the malware exfiltrates stolen data by creating its own calendar events with encrypted attachments dated far in the future (e.g., May 2050) to evade detection. It uses hybrid RSA and AES encryption for payload security. The malware also maintains a secondary communication channel via DNS tunneling to refresh its configuration and Azure AD credentials. Group-IB identified 12 victims, mainly in Israel, with active communications observed since June 3, 2026. The malware is linked with low confidence to the Iranian MOIS-associated OilRig subgroup Lyceum. HollowGraph does not contact attacker-controlled servers directly for payload delivery but relies on two commands, 'send' and 'get', to manage calendar events for C&C. Its configuration, including Azure AD tenant and client IDs and RSA keys, is stored locally in a log file.

HollowGraph enables stealthy command-and-control communication and data exfiltration through legitimate Microsoft 365 calendar events, complicating detection and response. It targets specific entities, primarily in Israel, and uses encrypted payloads and future-dated calendar events to avoid alerting mailbox owners. The malware’s use of legitimate cloud services for C&C reduces the likelihood of network-based detection. The impact is limited to entities with compromised Microsoft 365 accounts and does not indicate widespread opportunistic attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this malware abuses compromised Microsoft 365 accounts, mitigation should focus on securing accounts with strong authentication methods such as multi-factor authentication (MFA), monitoring for unusual calendar activity, and promptly investigating suspicious calendar events dated far in the future. Review and restrict application permissions related to Microsoft Graph API and Azure AD credentials. Organizations should also monitor DNS tunneling activity as a secondary communication channel. No official patch or fix is indicated for the malware itself, as it exploits legitimate cloud service features.