HollowGraph Malware Abuses Microsoft 365 Calendars for Covert C2 and Data Exfiltration
Written by AI from the linked story. Not reviewed by an editor. How this works
HollowGraph exploits trusted Microsoft 365 infrastructure by embedding command-and-control instructions and stolen file attachments inside calendar events deliberately dated to 2050, effectively camouflaging malicious traffic as routine business activity. This technique is particularly dangerous because most security tools and analysts whitelist Microsoft 365 traffic, leaving the covert channel undetected for extended periods. The malware further abuses DNS and Entra ID (Azure AD) to silently refresh authentication credentials via an attacker-controlled domain, maintaining persistent access. This attack highlights the growing trend of 'living-off-trusted-sites' (LOTS) tactics that bypass perimeter defenses by weaponizing legitimate SaaS platforms.
Tactical Insight
Immediate actions
- Audit Microsoft 365 calendar events for anomalous date ranges (e.g., events scheduled far in the future such as 2050) using Microsoft Defender or the Graph API.
- Review and revoke suspicious OAuth application permissions and delegated Entra ID credentials that may have been compromised by DNS-based token refresh attacks.
- Block or alert on DNS queries resolving to newly registered or unknown domains used for Entra ID authentication flows.
Detection measures
- Enable Microsoft 365 Unified Audit Logging and forward logs to a SIEM, creating specific detection rules for calendar event creation with anomalous timestamps or large attachments.
- Deploy Microsoft Defender for Cloud Apps (CASB) to monitor and baseline normal Microsoft 365 calendar and file attachment behaviors, alerting on statistical deviations.
- Implement DNS-layer security (e.g., Cisco Umbrella, Infoblox) to detect and block DNS-based credential harvesting via attacker-controlled domains.
Long-term improvements
- Apply the principle of least privilege to all Microsoft 365 service accounts and OAuth app registrations, regularly reviewing and removing unnecessary permissions.
- Establish a SaaS security posture management (SSPM) program to continuously audit Microsoft 365 configuration settings and detect misuse of platform features.
- Conduct regular threat hunting exercises focused on LOTS (Living-off-Trusted-Sites) techniques that abuse cloud productivity platforms for C2 and exfiltration.