# Iran-Linked HollowGraph Hides Its C2 Traffic Inside Your Calendar — Dated 2050
If a calendar invitation landed in your Microsoft 365 inbox for a meeting on May 13, 2050, you'd probably dismiss it as a glitch. That's exactly what the operators behind HollowGraph are counting on.
Discovered by Group-IB and disclosed this week, HollowGraph is a purpose-built implant that turns the Microsoft 365 Calendar into a two-way command-and-control channel. It never phones home to an attacker-controlled server. It never generates suspicious outbound connections to unfamiliar IP ranges. From a network monitoring perspective, it looks like an enterprise user managing their calendar.
## The Dead-Drop in Plain Sight
The mechanics are worth understanding in detail, because they're elegant in a way that should unsettle defenders.
HollowGraph compromises a Microsoft 365 account — in the cases Group-IB identified, an Israeli mailbox — and uses the Microsoft Graph API to interact with its calendar. Operators plant instructions as calendar events. The implant on the victim's machine reads those events, executes the commands, then reports back by creating its own calendar events with encrypted data attached as files.
Two commands drive the whole operation: get, which searches for operator-planted appointments and downloads new instructions, and send, which generates appointments with exfiltrated files attached. That's it. A minimal, purpose-fit design that reduces the implant's footprint and attack surface.
The 2050 timestamp on events isn't accidental — it pushes malicious appointments so far into the future that they sit at the bottom of the calendar view, below anything a legitimate user would scroll to. The mailbox owner is unlikely to ever notice them. The payloads themselves are protected with hybrid RSA plus AES encryption, meaning even if someone stumbled across the events, the attachments would be unreadable without the keys embedded in the implant's hardcoded configuration.
That configuration — containing the Microsoft Entra ID tenant ID, client ID and secret, target mailbox address, a C2 domain, and two RSA keys — gets written to disk as logAzure.txt at execution. It's a tradecraft tell: writing keys to disk is a risk, but it suggests the operators prioritized operational simplicity over perfect OPSEC.
## The Backup Plan: DNS Tunneling
HollowGraph doesn't bet everything on the calendar channel. When it needs to refresh its configuration or rotate Entra ID credentials, it falls back to DNS tunneling. This secondary channel is narrower — used for housekeeping rather than full C2 — but it provides resilience if the compromised 365 account gets locked or the calendar channel is disrupted.
The combination of channels is deliberate. Calendar-based C2 blends into normal enterprise noise; DNS tunneling is detectable but hard to block without breaking legitimate DNS resolution. Together, they give operators redundancy while keeping the primary channel as quiet as possible.
## Who Got Hit, and Who's Behind This
Group-IB identified 12 victims, with the earliest activity traced to June 3, 2026. Three were still actively communicating with the attacker infrastructure when the report was written. The recovered indicators — the compromised Israeli mailbox, malware samples uploaded from Israel — point toward a focused campaign against Israeli targets rather than opportunistic mass deployment.
Attribution sits at low confidence. Group-IB draws technical comparisons to Lyceum (also tracked as Hexane and SiameseKitten), an OilRig subgroup tied to Iran's Ministry of Intelligence and Security. The malware appears to be part of a variant of the broader Cavern framework, which Check Point linked to a threat actor called Cavern Manticore earlier this month. But Group-IB is direct about the limits of what they can say: the technical overlaps are "noteworthy" but not "sufficiently unique to support a high-confidence attribution."
That honesty is worth recognizing. The security industry has a bad habit of racing to attribution before the evidence is solid.
---
## HackWire Analysis
HollowGraph isn't the first malware to abuse legitimate cloud services for C2 — but it represents a meaningful step forward in the maturity of that technique, and the calendar-as-dead-drop mechanic deserves serious attention from defenders.
The living-off-trusted-infrastructure playbook has been evolving for years. We've seen attackers route C2 through Slack, Telegram, Notion, Dropbox, GitHub, Google Drive. Every new entrant to that list raises the same problem for defenders: how do you block attacker traffic when that traffic is indistinguishable from legitimate enterprise usage of the same service?
Microsoft 365 Calendar specifically is a worse case than most. It's a core productivity tool that virtually every enterprise depends on. You cannot block Graph API access to calendar functions without breaking Outlook, Teams integration, and hundreds of enterprise workflows. The attacker is exploiting the asymmetry between the cost of blocking (high) and the cost of abusing (near zero, if you have a compromised account to work with).
The 2050 timestamp trick is the kind of detail that reveals operational thinking. It's not technically sophisticated — it's socially sophisticated. The attackers are modeling how a real user interacts with their calendar and exploiting that behavior pattern. That kind of adversarial UX reasoning is characteristic of mature, state-linked operations.
What other coverage is missing: the hardcoded config written to logAzure.txt is a detection opportunity that defenders shouldn't ignore. If you're hunting in Microsoft environments, this file name on endpoints is a specific, actionable indicator right now. Beyond that, monitoring for anomalous Graph API calendar event creation — particularly events with attachments dated decades in the future — should be on every Microsoft 365 threat hunting checklist. Microsoft Sentinel and Defender for Cloud Apps can surface this with the right KQL queries.
The campaign's apparent focus on Israeli entities also fits a documented pattern of Iranian intelligence targeting against Israeli infrastructure that predates this operation by years. If you're operating in sectors that have historically been in Iran's crosshairs — defense, energy, telecommunications, government contractors — this is not a theoretical threat.
— HackWire Editorial
---
## Related Coverage