A malicious component dubbed HollowGraph uses the calendar feature in compromised Microsoft 365 mailboxes as a command-and-control channel to receive attacker commands and exfiltrate stolen data.
Researchers analysing the module believe it is part of the Cavern command-and-control framework that has been previously linked to an Iranian threat actor targeting entities in Israel.
At least 12 systems have been infected with HollowGraph, three of them actively communicating with the threat actor between June 3 and July 9.
The collected indicators suggest that the threat actor is focused on organizations in Israel, pointing to a targeted attack for espionage purposes.
Microsoft 365 mailbox abuse
In a report from cybersecurity company Group-IB, researchers say that HollowGraph uses hardcoded details to authenticate to the Microsoft Graph API via a compromised Microsoft 365 account.
The configuration file is stored as logAzure.txt to appear as a regular log file, and “includes the Microsoft Entra ID tenant ID, application (client) ID, client secret, target mailbox address, command-and-control (C2) domain, and two RSA keys.”
The two cryptographic keys are used to encrypt files before delivery to the attacker and to decrypt incoming tasks.
To remain under the radar, the threat actor creates calendar events dated May 13, 2050, with the title in specific formats. Commands and exfiltrated data are concealed within files attached to these calendar entries.
According to Group-IB’s analysis, HollowGraph supports only two commands that let it create calendar entries with stolen files in encrypted form and search for new ones with instructions from the threat actor:
- GET, to search for entries in the format “Event ID: <7-char-taskID>,” download and decrypt received instructions
- SEND, to create a calendar entry in the format “Boss{..}ID{..}” and attach stolen data encrypted with the public RSA key
The researchers describe the mailbox calendar as a “covert dead-drop,” with HollowGraph retrieving commands from events scheduled within a fixed one-hour window between 22:00 and 23:00 UTC on May 13, 2050.
Group-IB explains that the threat actor uses a hybrid encryption scheme that mixes RSA and AES-256-GCM algorithms to secure the communication over Microsoft Graph, keeping inbound and outbound channels cryptographically separated.
Source: Group-IB
HollowGraph has a second, unencrypted communication channel through DNS tunnelling, which is used to receive new Microsoft Entra ID details (Entra ID: tenantId, clientId, clientSecret, and mailbox) to authenticate to Microsoft Graph.
It retrieves the values through IPv6 AAAA record queries to the attacker-controlled domain cloudlanecdn[.]com, and updates the configuration files stored as logAzure.txt.
“Each returned IPv6 address (16 bytes) yields 14 usable payload bytes,” Group-IB explains. The malware assembles the payload from these 14-byte chunks, decodes it as UTF-8 text, and stores the result according to the corresponding configuration field.
“HOLLOWGRAPH demonstrates a high level of technical sophistication. Its use of trusted cloud infrastructure for command-and-control, hybrid encryption, DNS tunneling for credential refresh, and highly selective victim targeting collectively suggest that the threat actor possesses significant technical capabilities and operational maturity,” – Group-IB
While the researchers cannot attribute HollowGraph to a known threat actor, their “analysis identified several technical similarities with the Iranian-nexus threat actor Lyceum.”
However, the available evidence is insufficient to attribute the activity to the threat actor with high confidence. By contrast, the researchers assess with high confidence that HollowGraph is linked to the Cavern framework.
Group-IB suggests that organizations monitor Microsoft Graph and Microsoft 365 audit logs for suspicious application-driven calendar activity, particularly events in the far future, and unusual subjects and attachments.
It is also recommended to look for indicators such as the ‘cloudlanecdn[.]com’ domain and the ‘logAzure.txt’ file, enforce Conditional Access, restrict and audit OAuth client-credential applications, and monitor outbound DNS for tunneling patterns.
Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.
