HOLLOWGRAPH Malware Abuses Microsoft 365 Calendar for Stealthy C2
Written by AI from the linked story. Not reviewed by an editor. How this works
HOLLOWGRAPH represents a sophisticated evolution in attacker tradecraft by hijacking a trusted, everyday productivity tool — Microsoft 365 calendar invites — as a covert command-and-control and data exfiltration channel. Because the malicious traffic blends seamlessly with legitimate enterprise Microsoft 365 activity, traditional perimeter defenses and signature-based detection tools are largely ineffective against it. This technique exploits the implicit trust organizations place in sanctioned SaaS platforms, meaning security teams cannot simply block the service without disrupting business operations. The attack underscores a growing trend of 'living-off-trusted-sites' (LOTS) tactics, where adversaries abuse cloud services rather than custom infrastructure to avoid detection.
Tactical Insight
Immediate actions
- Deploy behavioral analytics (UEBA/EDR) capable of detecting anomalous Microsoft 365 API usage patterns, such as automated calendar invite creation or unusual Graph API calls.
- Audit and restrict which applications and service accounts have permissions to create or access Microsoft 365 calendar entries via the Microsoft Graph API.
- Hunt for indicators of compromise associated with HOLLOWGRAPH across endpoint telemetry and Microsoft 365 audit logs immediately.
Configuration & hardening measures
- Apply the principle of least privilege to all Microsoft 365 OAuth app registrations and service principals, revoking unnecessary calendar read/write permissions.
- Enable Microsoft 365 Advanced Audit logging and route logs to a centralised SIEM to capture Graph API activity and suspicious calendar operations.
- Configure Microsoft Defender for Cloud Apps (MCAS) policies to alert on atypical calendar data volumes or access patterns from endpoints.
Long-term improvements
- Conduct regular security awareness training that includes examples of trusted-platform abuse (LOTS attacks) so users and analysts recognise suspicious calendar-based activity.
- Establish a threat-hunting cadence specifically targeting abuse of SaaS collaboration tools (calendar, email, Teams) as C2 channels.
- Integrate cloud application activity (Microsoft 365, Google Workspace, etc.) into your incident response playbooks to ensure analysts have defined procedures for SaaS-based malware.