[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fAA38HqTlUyPmNqU3t2X4XHEyHZBylRa7IKo0XzZZILI":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":51,"controls":52},"86792063-8284-434e-ba83-e2b4da85ab4a","hollowgraph-malware-hijacks-microsoft-365-calendars-for-stealthy-cc","17f637d5-a3fb-4ed7-9e29-bcb87601ada7","HollowGraph Malware Hijacks Microsoft 365 Calendars for Stealthy C&C","HollowGraph demonstrates a sophisticated living-off-the-land technique by abusing trusted Microsoft 365 infrastructure — specifically the Graph API and calendar events — to blend malicious command-and-control traffic with legitimate business activity, making traditional network-based detection extremely difficult. By encoding tasking instructions and exfiltrated data into future-dated calendar events, attackers exploit the implicit trust organizations place in Microsoft's cloud services. The secondary DNS tunneling channel further deepens the attack's resilience, ensuring persistence even if the calendar-based channel is disrupted. This matters because most organizations lack fine-grained visibility into API-level activity within their Microsoft 365 tenants, leaving a critical blind spot that adversaries can exploit for extended dwell time.","**Immediate actions:**\n- Enable Microsoft 365 Unified Audit Logging and alert on anomalous Graph API calls, especially calendar read\u002Fwrite operations from non-human service accounts.\n- Review and revoke unnecessary OAuth application permissions granted to third-party apps accessing Microsoft 365 via the Graph API.\n- Deploy DNS filtering and monitoring to detect and block DNS tunneling patterns on all endpoints and network egress points.\n\n**Long-term improvements:**\n- Implement a Zero Trust application access model by enforcing least-privilege OAuth scopes and requiring admin consent for all Graph API permissions.\n- Establish a formal cloud API usage baseline so that deviations in Microsoft 365 calendar or mailbox API activity trigger automated alerts.\n- Integrate Microsoft 365 audit logs into your SIEM platform to correlate calendar-based anomalies with endpoint and network telemetry.\n\n**Detection measures:**\n- Build detection rules specifically targeting high-frequency or off-hours calendar event creation\u002Fmodification by service principals or compromised user accounts.\n- Use Microsoft Defender for Cloud Apps (MCAS) to enforce anomaly detection policies on Microsoft 365 API activity and flag data exfiltration patterns.\n- Conduct regular threat hunting exercises focused on abuse of trusted cloud APIs as C&C channels, referencing current adversary TTPs from MITRE ATT&CK.",[12,13,14,15,16,17,18,19,20,21,22,23],"MITRE ATT&CK T1102.001 – Web Service: Dead Drop Resolver","MITRE ATT&CK T1071.004 – Application Layer Protocol: DNS","MITRE ATT&CK T1550.001 – Use Alternate Authentication Material: Application Access Token","CIS Control 3 – Data Protection","CIS Control 6 – Access Control Management","CIS Control 8 – Audit Log Management","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-53 AC-3 – Access Enforcement","NIST SP 800-53 AU-12 – Audit Record Generation","NIST SP 800-53 SI-4 – System Monitoring","NIST SP 800-53 SC-7 – Boundary Protection","GDPR Article 32 – Security of Processing (monitoring and anomaly detection obligations)",{},"published","2026-07-21T12:20:25.299452+00:00","2026-07-21T12:20:24.99+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fwww.securityweek.com\u002Fnew-hollowgraph-malware-abuses-microsoft-365-calendar-for-cc-communication\u002F","new-hollowgraph-malware-abuses-microsoft-365-calendar-for-c-c-communication-29c35c","New HollowGraph Malware Abuses Microsoft 365 Calendar for C&C Communication",[33,39,45],{"id":34,"name":35,"slug":36,"description":37,"color":38},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":40,"name":41,"slug":42,"description":43,"color":44},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":46,"name":47,"slug":48,"description":49,"color":50},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",[],[53,57,61],{"slug":54,"name":55,"problem":56},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":58,"name":59,"problem":60},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":62,"name":63,"problem":64},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool."]