[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fHrNKjIg98mmp5_5U9cFHBZdcNrHprJqwUXTboforlFM":3},{"article":4,"iocs":54,"watch_terms":59,"solutions":60,"lesson":150},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"bb21cea7-e18b-468f-9047-2af6e14c5d99","New HollowGraph malware uses Microsoft Graph for stealthy C2 comms","new-hollowgraph-malware-uses-microsoft-graph-for-stealthy-c2-comms-18666f","A malicious component dubbed HollowGraph uses the calendar feature in compromised Microsoft 365 mailboxes as a command-and-control channel to receive attacker commands and exfiltrate stolen data. [...]","A new malware component named HollowGraph is leveraging Microsoft Graph's calendar feature within compromised Microsoft 365 mailboxes for command-and-control (C2) communications and data exfiltration. Researchers link it to the Cavern framework and suspect an Iranian threat actor targeting entities in Israel, with at least 12 systems infected. The malware uses encrypted calendar events for data transfer and DNS tunneling to update its credentials.","HollowGraph malware uses Microsoft Graph calendar events for C2 comms and data exfiltration.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fnew-hollowgraph-malware-uses-microsoft-graph-for-stealthy-c2-comms\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F07\u002F20\u002FCalendar.jpg","2026-07-20T17:43:01+00:00","2026-07-20T18:00:27.303627+00:00",8,[17,20,23,25,28],{"name":18,"type":19},"Microsoft Graph","technology",{"name":21,"type":22},"Microsoft 365","product",{"name":24,"type":19},"DNS tunneling",{"name":26,"type":27},"Lyceum","threat_actor",{"name":29,"type":30},"Cavern framework","campaign","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":31,"icon":33,"name":34,"slug":35},null,"Malware","malware",[37,42,44,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55],{"type":56,"value":57,"context":58},"domain","cloudlanecdn[.]com","Used for DNS tunneling to receive new Microsoft Entra ID details.",[21],{"controls":61,"vendors":146},[62,91,117],{"slug":63,"name":64,"problem":65,"products":66},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[67,75,83],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"slug":92,"name":93,"problem":94,"products":95},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[96,104,112],{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"orca-security","Orca Security","\u002Fvendor-logos\u002Forca-security.png","orca-cloud-security-platform","Orca Cloud Security Platform","https:\u002F\u002Forca.security\u002Fplatform\u002F","Agentless cloud security platform for posture, vulnerabilities and data exposure.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"wiz","Wiz","\u002Fvendor-logos\u002Fwiz.png","wiz-cloud","Wiz Cloud","https:\u002F\u002Fwww.wiz.io\u002Fplatform\u002Fwiz-cloud","Agentless cloud security posture and attack path analysis across major cloud providers.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":113,"product_name":114,"url":115,"description":116},"defender-for-cloud","Microsoft Defender for Cloud","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fcloud-security\u002Fmicrosoft-defender-cloud","Cloud posture management and workload protection for Azure, AWS and Google Cloud.",{"slug":118,"name":119,"problem":120,"products":121},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[122,130,138],{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",[147],{"slug":84,"name":85,"logo_path":86,"roles":148},[149],"affected",{"slug":151,"title":152,"body":153,"framework_refs":154,"framework_notes":170},"hollowgraph-malware-abuses-microsoft-graph-api-for-covert-c2-via-calendar-events","HollowGraph Malware Abuses Microsoft Graph API for Covert C2 via Calendar Events","HollowGraph exploits legitimate Microsoft 365 infrastructure — specifically Graph API calendar events — to blend malicious command-and-control traffic with normal business communications, making it extremely difficult to detect through traditional network monitoring. This 'living-off-trusted-services' technique means perimeter defenses and signature-based tools are largely blind to the threat, as the malicious traffic appears indistinguishable from routine Microsoft 365 activity. The use of DNS tunneling for credential updates adds a secondary covert channel, compounding detection difficulty. Organizations that lack deep behavioral monitoring of Microsoft 365 API activity and outbound DNS patterns are particularly exposed. This attack underscores why defenders must treat trusted cloud platforms as potential attack surfaces, not inherently safe channels.",[155,156,157,158,159,160,161,162,163,164,165,166,167,168,169],"CIS Control 3: Data Protection","CIS Control 6: Access Control Management","CIS Control 8: Audit Log Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 AC-17: Remote Access","NIST SP 800-53 AU-6: Audit Record Review, Analysis, and Reporting","NIST SP 800-53 SI-4: System Monitoring","NIST SP 800-53 CA-7: Continuous Monitoring","MITRE ATT&CK T1071.001: Application Layer Protocol – Web Protocols","MITRE ATT&CK T1048: Exfiltration Over Alternative Protocol","MITRE ATT&CK T1071.004: Application Layer Protocol – DNS","MITRE ATT&CK T1550.001: Use Alternate Authentication Material – Application Access Token","GDPR Article 32: Security of Processing (for EU-adjacent supply chain considerations)","ITIL Change Management: Controlling OAuth app registration and API permission changes",{}]