# When Your Calendar Becomes a Command Post: HollowGraph and the Art of Hiding in Plain Sight
Your Microsoft 365 tenant is not just storing emails and meeting invites. For at least twelve organizations — three of which were actively under control as recently as July 9 — it was also routing encrypted commands to a threat actor who almost certainly works for or with Iranian intelligence.
That's what Group-IB disclosed this week in their analysis of HollowGraph, a malware module that turns Microsoft 365 calendar events into a covert dead-drop for command-and-control. The campaign is linked to the Cavern C2 framework, which researchers tie with high confidence to an Iranian-nexus threat actor. Attribution to the specific group Lyceum remains moderate — enough to name it, not enough to bet on it.
The target profile is narrow: organizations in Israel, and the operational fingerprint suggests espionage, not ransomware. But the technique is transferable, and that's what every defender outside the Middle East should be reading this story for.
## A Dead-Drop Buried in 2050
The mechanics are worth understanding in detail, because the ingenuity is the threat.
HollowGraph authenticates to the Microsoft Graph API using hardcoded credentials from a compromised Microsoft 365 account. The configuration — tenant ID, client ID, client secret, target mailbox, C2 domain, and two RSA keys — is stored locally as logAzure.txt, designed to look like a routine log file to anyone doing a quick filesystem review.
Once authenticated, the malware uses calendar events as its channel. Not upcoming meetings. Not reminders anyone would check. Calendar entries dated May 13, 2050, with titles formatted to specific patterns the malware knows to search for.
Commands arrive as file attachments on those events. Data leaves the same way — stolen files encrypted with the attacker's RSA public key, attached to outbound calendar entries. The retrieval window is a one-hour slot between 22:00 and 23:00 UTC on that same distant future date. Miss the window, miss the command.
The encryption is a hybrid scheme — RSA for key exchange, AES-256-GCM for the payload — with inbound and outbound channels cryptographically separated. That's not amateur work. Whoever designed this was thinking about operational security at the protocol level.
But here's the piece that's easy to gloss over: HollowGraph has a second communication channel entirely. When it needs fresh Microsoft Entra ID credentials — to rotate out of a burned account, presumably — it doesn't use the Graph API at all. It queries IPv6 AAAA records from an attacker-controlled domain (cloudlanecdn[.]com). The domain name is crafted to look like a content delivery network. The IPv6 addresses aren't real network addresses; they're payload chunks, 14 usable bytes each, assembled into a UTF-8 configuration update.
This dual-channel design means that even if Microsoft detects the Graph API abuse and terminates the compromised account, the malware can receive replacement credentials and keep operating — silently, through DNS, which most organizations log inconsistently at best.
## Why Trusted Infrastructure Is Now the Attack Surface
This isn't the first time threat actors have used legitimate cloud services as C2 infrastructure, and it won't be the last. The lineage is clear: Turla routing commands through OneDrive and email back in 2022. APT29 abusing Dropbox, Trello, and Slack. Chinese state groups cycling through Google Drive and OneDrive. The pattern has a name now — cloud-native C2, or sometimes "living off trusted land" — and HollowGraph is among the most technically sophisticated implementations documented so far.
The appeal is obvious: traffic to graph.microsoft.com looks identical whether it's a legitimate Teams integration or a threat actor pulling encrypted task files from a calendar event. You cannot block the domain. Your CASB likely whitelists it. Your DLP has no concept of a malicious calendar attachment because the concept barely existed until now.
What makes HollowGraph particularly nasty is the specificity of its evasion. The 2050 date means the events won't appear in any normal calendar view. The one-hour communication window limits exposure and complicates behavioral analysis. The fake log filename means automated scanners that look for suspicious file names will walk right past the credential store.
## What Defenders Can Actually Do
The honest answer is that most organizations don't have the logging infrastructure to detect this today. But the gap is closable.
Microsoft Graph API audit logs are your first line. Every application authenticating to Graph against a mailbox should be inventoried. Unfamiliar clientId values — especially those with calendar read/write permissions — are the signal. Microsoft's Entra ID sign-in logs will show non-interactive sign-ins by application; look for unusual tenants and unusual permission scopes.
Calendar event monitoring is less mature but possible. Microsoft Purview can flag anomalous calendar activity; events with far-future dates and file attachments that don't match any organizational pattern are worth investigating. Events dated 2050 are not ambiguous.
DNS logging for AAAA queries is something most organizations enable but rarely analyze. Queries to domains that look like CDNs but resolve to non-RFC-compliant IPv6 addresses — or that return addresses in unusual blocks — can surface tunneling. A security information and event management (SIEM) rule checking for excessive AAAA queries to newly-registered or low-reputation domains would have had a chance at catching this.
Finally: OAuth application audits. Any application granted access to a mailbox should be reviewed quarterly. Compromised service principals — where the attacker has a client secret rather than user credentials — are a persistent problem and one that too few organizations track.
## HackWire Analysis
The HollowGraph disclosure arrives at an interesting moment. The Microsoft 365 ecosystem has been under sustained attack from multiple directions — credential phishing via adversary-in-the-middle proxies, BEC campaigns, and now this: a threat actor who gets inside a tenant and uses it as a communications relay, never sending a single phishing email out, never touching a file server, leaving almost nothing in traditional log sources.
What's missing from most coverage of this story is the credential refresh mechanism. The DNS tunneling via AAAA records gets a paragraph, but it's arguably the most dangerous part of the design. It means HollowGraph is architecturally resilient. A burned M365 account doesn't kill the operation — it just triggers a refresh cycle. Unless defenders are monitoring DNS at a level granular enough to catch IPv6-packed payloads from CDN-lookalike domains, they have no way to cut the C2 channel entirely.
There's also a question worth asking about scale. Twelve confirmed infections is a small number. But Cavern, the C2 framework this module plugs into, was built to be extensible. HollowGraph is one module. The question isn't how many organizations this particular operator hit — it's how many other modules in the same framework are doing similar things that nobody has documented yet.
The Iran-Israel angle will dominate the attribution discussion, but any defender treating this as a Middle East problem is making a mistake. The technique is doctrine-agnostic. A Chinese APT, a Russian GRU unit, or a financially motivated crew with enough sophistication could clone this approach against any sector. The Microsoft 365 calendar is not a patched vulnerability. It will still be there tomorrow.
For defenders: start with the Graph API audit logs this week. Not next quarter.
— HackWire Editorial
## Related Coverage