New Malware HollowGraph Uses Microsoft 365 Calendars as Covert C2 Channel, Targets Israeli Organizations

Security researchers at Group-IB have uncovered a new malware strain called HollowGraph that abuses Microsoft 365 calendar events as a command-and-control channel, targeting Israeli organizations for espionage.

This article was drafted with AI assistance from multiple sources and was reviewed and approved by a human editor before publication.

Security researchers at Group-IB have discovered a new malware strain, dubbed HollowGraph, which abuses Microsoft 365 calendar events as a covert command-and-control (C2) channel. The malware has been used to target organizations in Israel for espionage purposes.

According to Group-IB, HollowGraph is part of the Cavern C2 framework with high confidence. The researchers also noted similarities to the Iranian-nexus threat actor Lyceum, though with low confidence.

The malware infected 12 systems, with three actively communicating between June 3 and July 9, 2026. HollowGraph uses calendar events dated May 13, 2050, with titles in specific formats to hide commands and exfiltrated data in calendar entry attachments.

HollowGraph supports two primary commands: create a calendar entry with stolen files and search for new instructions. The dead-drop window for these operations is between 22:00 and 23:00 UTC on May 13, 2050.

The malware employs hybrid encryption using RSA and AES-256-GCM, with inbound and outbound channels cryptographically separated. Additionally, a second unencrypted channel uses DNS tunneling for credential refresh. Credentials are retrieved via IPv6 AAAA queries to cloudlanecdn[.]com, with each IPv6 address yielding 14 usable payload bytes. The malware's configuration is stored as logAzure.txt.

Group-IB stated, "HOLLOWGRAPH demonstrates a high level of technical sophistication..." and described it as "an advanced and highly targeted espionage threat."