New HollowGraph malware uses Microsoft Graph for stealthy C2 comms
HollowGraph malware uses Microsoft Graph calendar events for C2 comms and data exfiltration.
A new malware component named HollowGraph is leveraging Microsoft Graph's calendar feature within compromised Microsoft 365 mailboxes for command-and-control (C2) communications and data exfiltration. Researchers link it to the Cavern framework and suspect an Iranian threat actor targeting entities in Israel, with at least 12 systems infected. The malware uses encrypted calendar events for data transfer and DNS tunneling to update its credentials.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft 365?
Get an email when a new story names Microsoft 365, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonHollowGraph exploits legitimate Microsoft 365 infrastructure — specifically Graph API calendar events — to blend malicious command-and-control traffic with normal business communications, making it extremely difficult to detect through traditional network monitoring. This 'living-off-trusted-services' technique means perimeter defenses and signature-based tools are largely blind to the threat, as the malicious traffic appears indistinguishable from routine Microsoft 365 activity. The use of DNS tunneling for credential updates adds a secondary covert channel, compounding detection difficulty. Organizations that lack deep behavioral monitoring of Microsoft 365 API activity and outbound DNS patterns are particularly exposed. This attack underscores why defenders must treat trusted cloud platforms as potential attack surfaces, not inherently safe channels.
What helps against this
How we list vendors
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Cloud security posture management (CSPM and CNAPP)
Misconfigured cloud storage and over-permissive roles get caught before they leak.
- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- domain — cloudlanecdn[.]com