[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f8qlka4eq1ESLKkt9jL0mrlXfQAnMeUOQi-KjVbjQ5ks":3},{"article":4,"iocs":58,"watch_terms":76,"solutions":77,"lesson":160},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"6e1cd644-c7d1-4e97-91f8-2ffb61e3b9b5","HollowGraph Malware Hides C2 and Stolen Files in Microsoft 365 Events Dated 2050","hollowgraph-malware-hides-c2-and-stolen-files-in-microsoft-365-events-dated-2050-d78599","A newly discovered espionage implant has been using a hijacked Microsoft 365 calendar as its command channel, planting operator instructions and smuggling out stolen files as attachments on calendar events dated to the year 2050. Group-IB, which named the malware HollowGraph, says the approach moves tasking and stolen data through legitimate Microsoft Graph API traffic, so the activity looks","A new espionage malware named HollowGraph has been discovered using hijacked Microsoft 365 calendars as a command and control channel. It hides operator instructions and exfiltrates stolen files as attachments within calendar events set for the year 2050, making the traffic appear as legitimate Microsoft 365 activity. The malware also uses DNS to refresh Entra ID login details via an attacker-controlled domain.","HollowGraph malware uses Microsoft 365 calendar events dated 2050 for C2 and data exfiltration.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Fhollowgraph-malware-hides-c2-and-stolen.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjho_D61rng1SKt_vyKBuuHeBlTm5uQ55-9SSSXuktMbO6iE0khzlKYA0mmaNLDVejgglz1kKnBkINCbI_KdqdH48UBw9bALf9l7ebuab84zp3aMnIHAbvm4OI62y4_QChmk-SnrUFN6AZ2bJgkvZasI4eApEFPX4M-94ZRO_MfQTjX52CaYQ-Ui2trHfs\u002Fs1600\u002Fms365.jpg","2026-07-20T14:33:43+00:00","2026-07-20T16:00:06.656174+00:00",9,[17,20,22,24,26,29],{"name":18,"type":19},"Microsoft 365","product",{"name":21,"type":19},"Microsoft Graph API",{"name":23,"type":19},"Entra ID",{"name":25,"type":19},"Azure AD",{"name":27,"type":28},"Microsoft","vendor",{"name":30,"type":31},"Cavern Manticore","threat_actor","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":32,"icon":34,"name":35,"slug":36},null,"Threat Intelligence","threat-intelligence",[38,43,48,53],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":54},{"id":55,"icon":34,"name":56,"slug":57},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",[59,63,66,70,73],{"type":60,"value":61,"context":62},"domain","cloudlanecdn[.]com","Attacker-controlled domain used for refreshing Entra ID login details.",{"type":57,"value":64,"context":65},"HollowGraph","Name of the espionage implant.",{"type":67,"value":68,"context":69},"mitre_attack","T1071.004","Application Layer Protocol: DNS",{"type":67,"value":71,"context":72},"T1105","Ingress Tool Transfer",{"type":67,"value":74,"context":75},"T1041","Exfiltration Over C2 Channel",[27,18,21],{"controls":78,"vendors":156},[79,107,130],{"slug":80,"name":81,"problem":82,"products":83},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[84,92,99],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":93,"vendor_name":27,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"slug":108,"name":109,"problem":110,"products":111},"saas-security-posture","SaaS security posture management (SSPM)","Business apps like Microsoft 365 and Salesforce stop leaking through risky settings and connected apps.",[112,119,124],{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":114,"url":117,"description":118},"obsidian-security","Obsidian Security","\u002Fvendor-logos\u002Fobsidian-security.png","obsidian","https:\u002F\u002Fwww.obsidiansecurity.com\u002F","SaaS posture management and detection of account and integration compromise.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":120,"product_name":121,"url":122,"description":123},"falcon-shield","Falcon Shield","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Ffalcon-shield\u002F","SaaS security posture management, from CrowdStrike's acquisition of Adaptive Shield.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":125,"product_name":126,"url":128,"description":129},"appomni","AppOmni","\u002Fvendor-logos\u002Fappomni.png","https:\u002F\u002Fappomni.com\u002F","SaaS security posture management for platforms such as Salesforce, Microsoft 365 and ServiceNow.",{"slug":131,"name":132,"problem":133,"products":134},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[135,143,151],{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"vendor_slug":144,"vendor_name":145,"vendor_logo":146,"product_slug":147,"product_name":148,"url":149,"description":150},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":93,"vendor_name":27,"vendor_logo":94,"product_slug":152,"product_name":153,"url":154,"description":155},"purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",[157],{"slug":93,"name":27,"logo_path":94,"roles":158},[159],"affected",{"slug":161,"title":162,"body":163,"framework_refs":164,"framework_notes":179},"hollowgraph-malware-abuses-microsoft-365-calendars-for-covert-c2-and-data-exfiltration","HollowGraph Malware Abuses Microsoft 365 Calendars for Covert C2 and Data Exfiltration","HollowGraph exploits trusted Microsoft 365 infrastructure by embedding command-and-control instructions and stolen file attachments inside calendar events deliberately dated to 2050, effectively camouflaging malicious traffic as routine business activity. This technique is particularly dangerous because most security tools and analysts whitelist Microsoft 365 traffic, leaving the covert channel undetected for extended periods. The malware further abuses DNS and Entra ID (Azure AD) to silently refresh authentication credentials via an attacker-controlled domain, maintaining persistent access. This attack highlights the growing trend of 'living-off-trusted-sites' (LOTS) tactics that bypass perimeter defenses by weaponizing legitimate SaaS platforms.",[165,166,167,168,169,170,171,172,173,174,175,176,177,178],"CIS Control 3: Data Protection","CIS Control 6: Access Control Management","CIS Control 8: Audit Log Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 AU-6: Audit Record Review, Analysis, and Reporting","NIST SP 800-53 SI-4: System Monitoring","NIST SP 800-53 SC-7: Boundary Protection","MITRE ATT&CK T1102: Web Service (C2 via trusted services)","MITRE ATT&CK T1048: Exfiltration Over Alternative Protocol","MITRE ATT&CK T1078: Valid Accounts","GDPR Article 32: Security of Processing","NIST CSF DE.CM-1: Network Monitoring","NIST CSF PR.AC-4: Access Permissions and Authorizations",{}]