[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fqTBJ2rgSOwv8HRjeCWDZVHtFKmNkrO0g_ra35W1saQk":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":26,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":53,"controls":54},"832bd843-0fb6-41cb-b8fd-4a2aa0f8b70a","hollowgraph-malware-abuses-microsoft-365-calendars-for-covert-c2-and-data-exfiltration","6e1cd644-c7d1-4e97-91f8-2ffb61e3b9b5","HollowGraph Malware Abuses Microsoft 365 Calendars for Covert C2 and Data Exfiltration","HollowGraph exploits trusted Microsoft 365 infrastructure by embedding command-and-control instructions and stolen file attachments inside calendar events deliberately dated to 2050, effectively camouflaging malicious traffic as routine business activity. This technique is particularly dangerous because most security tools and analysts whitelist Microsoft 365 traffic, leaving the covert channel undetected for extended periods. The malware further abuses DNS and Entra ID (Azure AD) to silently refresh authentication credentials via an attacker-controlled domain, maintaining persistent access. This attack highlights the growing trend of 'living-off-trusted-sites' (LOTS) tactics that bypass perimeter defenses by weaponizing legitimate SaaS platforms.","**Immediate actions:**\n- Audit Microsoft 365 calendar events for anomalous date ranges (e.g., events scheduled far in the future such as 2050) using Microsoft Defender or the Graph API.\n- Review and revoke suspicious OAuth application permissions and delegated Entra ID credentials that may have been compromised by DNS-based token refresh attacks.\n- Block or alert on DNS queries resolving to newly registered or unknown domains used for Entra ID authentication flows.\n\n**Detection measures:**\n- Enable Microsoft 365 Unified Audit Logging and forward logs to a SIEM, creating specific detection rules for calendar event creation with anomalous timestamps or large attachments.\n- Deploy Microsoft Defender for Cloud Apps (CASB) to monitor and baseline normal Microsoft 365 calendar and file attachment behaviors, alerting on statistical deviations.\n- Implement DNS-layer security (e.g., Cisco Umbrella, Infoblox) to detect and block DNS-based credential harvesting via attacker-controlled domains.\n\n**Long-term improvements:**\n- Apply the principle of least privilege to all Microsoft 365 service accounts and OAuth app registrations, regularly reviewing and removing unnecessary permissions.\n- Establish a SaaS security posture management (SSPM) program to continuously audit Microsoft 365 configuration settings and detect misuse of platform features.\n- Conduct regular threat hunting exercises focused on LOTS (Living-off-Trusted-Sites) techniques that abuse cloud productivity platforms for C2 and exfiltration.",[12,13,14,15,16,17,18,19,20,21,22,23,24,25],"CIS Control 3: Data Protection","CIS Control 6: Access Control Management","CIS Control 8: Audit Log Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 AU-6: Audit Record Review, Analysis, and Reporting","NIST SP 800-53 SI-4: System Monitoring","NIST SP 800-53 SC-7: Boundary Protection","MITRE ATT&CK T1102: Web Service (C2 via trusted services)","MITRE ATT&CK T1048: Exfiltration Over Alternative Protocol","MITRE ATT&CK T1078: Valid Accounts","GDPR Article 32: Security of Processing","NIST CSF DE.CM-1: Network Monitoring","NIST CSF PR.AC-4: Access Permissions and Authorizations",{},"published","2026-07-20T17:20:26.24176+00:00","2026-07-20T17:20:26.13+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Fhollowgraph-malware-hides-c2-and-stolen.html","hollowgraph-malware-hides-c2-and-stolen-files-in-microsoft-365-events-dated-2050-d78599","HollowGraph Malware Hides C2 and Stolen Files in Microsoft 365 Events Dated 2050",[35,41,47],{"id":36,"name":37,"slug":38,"description":39,"color":40},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":42,"name":43,"slug":44,"description":45,"color":46},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":48,"name":49,"slug":50,"description":51,"color":52},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[55,59,63],{"slug":56,"name":57,"problem":58},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":60,"name":61,"problem":62},"saas-security-posture","SaaS security posture management (SSPM)","Business apps like Microsoft 365 and Salesforce stop leaking through risky settings and connected apps.",{"slug":64,"name":65,"problem":66},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool."]