A newly identified Windows malware sample abuses Microsoft Graph API to transform a compromised Microsoft 365 calendar into a covert two-way command and control (C2) channel.
Researchers at Group-IB dubbed the highly sophisticated malware sample HollowGraph and attributed it, with high confidence, to the Cavern backdoor framework.
Analysis by Group-IB found that the HollowGraph attack is highly targeted and focuses on Israeli entities. This is because the compromised mailbox identified was associated with an Israeli organization.
In addition, the malware files uploaded were from Israel and files associated with the broader Cavern framework were also uploaded from Israel.
Group-IB said it identified 12 systems infected with the HollowGraph malware and earliest observed communication between a victim and attacker occurred on June 3, 2026. The most recent example was identified on July 9.
“The relatively small number of identified victims suggests that the operation is highly targeted rather than opportunistic,” the researchers said in a July 20 post.
While the firm could not confidently attribute to any previously identified threat actor, researchers identified several technical similarities with the Iranian-nexus threat actor Lyceum for espionage activities.
“The sophistication of the malware, combined with the disciplined, narrowly scoped targeting of Israeli entities, points to a capable and well-resourced adversary,” the researchers said.
HollowGraph Uses Trusted Microsoft Services to Evade Detection
The malware supports two commands, get and send, and relies entirely on trusted third-party infrastructure for communication, never reaching out directly to attacker-owned servers for payload delivery.
The send command generates calendar appointments with encrypted stolen files attached.
Meanwhile, the get command searches for appointments planted by the operator and downloads the attached instructions.
HollowGraph also uses DNS tunneling to deliver and refresh Microsoft Entra ID (Azure AD) credentials needed to authenticate to the Graph channel. This channel is not encrypted.
For encryption it uses a hybrid scheme com RSA and AES-256-GCM secures Graph communications, with distinct RSA key pairs used for each direction (inbound vs. outbound), according to Group-IB research.
On its link to the Cavern framework, Group-IB said several technical characteristics strongly suggest HollowGraph is part of this and the broader toolkit.
Among these characteristics are the command format. The component is invoked with the string format _;;__,__,_, which matches Cavern’s command syntax.
The attackers issued commands including MzU=, which decodes to 003, a Toggle debug logging instruction command classified as an agent self command for the Cavern malware.
Finally, it has a matching command structure from the C2 server. The observed tasking mirrors Cavern’s format, e.g. {“cid”: “oXhLaJ0ZvtPb9XB”, “type”: “self”, “cmd”: “003_;;__,_”}
These technical details have led Group-IB to assess that HollowGraph is part of a different variant of the Cavern framework.
The cybersecurity firm recommended organizations to continuously hunt for indicators associated with HollowGraph and to monitor Microsoft Graph API activity and Microsoft 365 mailbox audit for anomalous calendar operations. Such operations include event creation, attachment uploads and subject changes performed by an application rather than a user.
