The HOLLOWGRAPH malware is a .NET DLL with a deliberately narrow interface. It supports exactly two commands. The get command retrieves encrypted instructions from a file attached to a calendar event. The send command creates a new calendar event and attaches encrypted stolen files. That is the entire command surface. Everything else — payloads, staging, updates — either lives inside those two operations or comes through a separate credential-refresh channel.

Because there is no third command that reaches an attacker-controlled server for additional payloads, defenders looking for outbound connections to suspicious IPs or newly registered domains will not find them. The compromised Microsoft 365 tenant is the entire communication surface. That design choice is what makes the implant hard to catch with conventional network-based detection.

Every operational calendar event uses the same date: May 13, 2050. Twenty-four years past the mailbox owner’s normal view. To hand over new tasking, the attacker creates a calendar event on that date with a specific title format — a bare GUID, or a subject that starts with “Event ID:” or “Boss{..}ID{..}” — and attaches the encrypted instructions as a file named File{n}.txt. The HOLLOWGRAPH malware queries the calendar for events matching those patterns and pulls the attachments.

To exfiltrate stolen files, the malware inverts the flow. It creates its own May 13, 2050 event, encrypts the stolen data, and attaches it as a file. The operator later retrieves the same event and decrypts the attachment offline. Neither direction of communication ever touches infrastructure the attacker owns. The mailbox itself is the entire command channel.

Every operation the HOLLOWGRAPH malware performs — reading tasking, writing exfiltration events, refreshing tokens — happens through Microsoft Graph API calls issued from a compromised Microsoft 365 tenant. From a network telemetry perspective, the traffic is indistinguishable from a legitimate Microsoft 365 application doing its normal job. There is no unusual destination, no strange domain, no self-signed certificate.

The implant authenticates using hardcoded credentials stored on disk in a file called logAzure.txt — deliberately named to look like a mundane log. The config holds the Microsoft Entra ID tenant ID, application (client) ID, client secret, target mailbox address, C2 domain, and two RSA keys. Everything the malware needs to keep operating lives in that one file plus the DNS credential-refresh channel described below.

The HOLLOWGRAPH malware does not trust the mailbox owner or Microsoft itself with the payload contents. Every attachment is encrypted using a hybrid RSA + AES-256-GCM scheme. Two RSA keys sit in the config file: one used to decrypt incoming tasking, one used to encrypt outgoing exfiltration. That separation means that even if a defender captures the malware binary and the config, cracking one direction does not automatically expose the other.

The choice of AES-256-GCM specifically is worth noting. GCM provides authenticated encryption, so the implant can detect any tampering with a fetched payload before executing it. That protects the operator from a defender who spots a HOLLOWGRAPH event and tries to inject their own instructions — the malware will reject any payload it cannot authenticate. It also protects the operator from Microsoft, which could in principle read any file attached to a calendar event but cannot break the payload encryption without the private keys.

This is a deliberate cryptographic posture, not an implementation detail. State-adjacent espionage operations regularly cycle through cryptographic best practices because their tradecraft has to survive both discovery of the binary and hostile analysis by the victim’s cloud provider. HOLLOWGRAPH’s use of RSA key separation plus authenticated AES-256-GCM is textbook for that threat model.

Compromised Microsoft 365 credentials do not last forever. When the tenant’s Entra ID app secret expires or gets rotated, the calendar channel dies. HOLLOWGRAPH handles this with a second, quieter channel: DNS tunneling. The implant sends IPv6 AAAA record queries to an attacker-controlled domain — cloudlanecdn[.]com in the observed samples — and receives updated Microsoft Entra ID credentials encoded in the DNS responses. It then writes the fresh values back to logAzure.txt and continues operating on the calendar as if nothing changed.

This is why credential rotation alone will not evict the HOLLOWGRAPH malware. If the DNS backchannel is functional, the operator can push new credentials at any time and re-establish the calendar C2 channel within minutes. Effective response requires severing both channels simultaneously — kill the app registration and block the DNS domain in the same window.

Group-IB links the HOLLOWGRAPH malware to a larger toolkit with high confidence to the Cavern framework, a modular espionage kit that Check Point profiled earlier in July under the Cavern Manticore label. Cavern is built from separate plugins, each handling a discrete task — persistence, credential access, data collection, C2 — and modules from the framework have previously been tied to Iran-nexus activity. HOLLOWGRAPH looks like the C2 module in that architecture.

The narrower attribution to a specific Iranian subgroup is more cautious. Group-IB flags technical similarities to Lyceum, also tracked as Hexane and SiameseKitten, an MOIS-linked cluster inside the OilRig ecosystem. But the confidence rating on that specific link is low. The evidence is enough to plant a flag in the Iran-nexus category and Cavern framework family, but not to name a specific operator group with certainty.

All observed evidence points to a focused espionage operation against Israeli entities. Group-IB identified 12 infected systems in total across its observation window, with only three actively communicating during the study period. The earliest recorded contact between a victim and the attacker infrastructure dates to June 3, 2026, and the most recent to July 9, 2026. That footprint is characteristic of precision espionage, not opportunistic malware distribution.

Twelve compromises is a small number, and it is exactly the kind of small number that suggests the operator selected targets deliberately. Mass-market ransomware works on volume; state-adjacent espionage works on placement. Every one of those twelve mailboxes was picked because someone judged the intelligence value worth the operational cost of building a HOLLOWGRAPH-tier implant to reach it.

The HOLLOWGRAPH malware exploits no Microsoft software vulnerability. Group-IB is explicit on this point. The implant rides a compromised Microsoft 365 account and the Graph API’s normal, documented functionality. That means there is no CVE to track, no CISA KEV entry to enforce, and no Patch Tuesday build that closes the door. This category of threat sits entirely outside the vulnerability-management workflow that most enterprise security programs are optimized around.

The consequence is that defense becomes an identity and application posture problem, not a patching problem. The controls that matter are Conditional Access policies on the OAuth application layer, secret rotation, anomalous-token detection, and hunting on calendar activity itself. None of those are new capabilities, but for many organizations they are less mature than the traditional patch pipeline, which means the HOLLOWGRAPH class of threat can operate in the gap.

This is where the Klue supply-chain breach story earlier this summer becomes relevant context. A single stale OAuth credential issued in 2022 and never decommissioned turned into a mass compromise across roughly 200 companies. The same access-hygiene gap that made Klue’s four-year-old token dangerous is exactly the gap HOLLOWGRAPH is designed to sit inside. Every long-lived, under-audited service principal with Graph API access is a candidate landing zone for the next implant that copies this playbook.

Group-IB’s detection guidance leans on the malware’s own habits. The sharpest signal is the calendar itself. Hunt for events dated May 13, 2050 with title patterns that are bare GUIDs, or that follow the “Event ID:” and “Boss{..}ID{..}” formats. Look for attachments named File{n}.txt on those events. On the identity side, audit which client-credential OAuth apps can reach Microsoft Graph, alert on newly created client secrets, and enforce Conditional Access with anomalous-token detection.

On the network side, monitor for AAAA DNS queries to cloudlanecdn[.]com, which is the observed credential-refresh domain. And watch for the logAzure.txt file appearing on endpoint disk — the config file’s name is disguised as a log, but its presence at unexpected paths is a strong signal. Group-IB explicitly warns not to treat every calendar event in 2050 as evidence of compromise, since some legitimate calendars do have far-future placeholders — the title pattern and the attachments are the distinguishing markers.