Researchers at Group-IB have uncovered a new espionage tool, dubbed HOLLOWGRAPH, that hides its command and control traffic in an unlikely place: the calendar of a hijacked Microsoft 365 mailbox. By planting and reading calendar events through Microsoft's own cloud, the malware blends its activity into ordinary corporate traffic and slips past defenses that watch for connections to suspicious outside servers.
Group-IB says the campaign is tightly focused on organizations in Israel, with the compromised mailbox and the malware samples all tied to the country. It reads as targeted espionage rather than a smash and grab: the team found at least 12 infected systems but only about three actively talking to the attacker, a sign of disciplined, hand picked targeting. The earliest activity dates to early June 2026.
How the calendar becomes a dead drop
HOLLOWGRAPH abuses the Microsoft Graph API, the standard programming interface for Microsoft 365, to treat a victim's calendar as a two way dead drop. Operators plant instructions as calendar events; the malware reads them, carries out the task, then exfiltrates stolen files by creating its own events with the data attached as encrypted files. To keep the mailbox owner from noticing, every one of these events is dated far into the future, to 13 May 2050. Because all of this flows through trusted Microsoft cloud infrastructure, the malware never has to connect directly to an attacker owned server for its main channel.
The implant supports just two commands, get and send, and wraps the calendar payloads in layered RSA and AES-256 encryption, using separate keys for incoming tasks and outgoing stolen data. A second, quieter channel handles credential upkeep: the malware performs DNS tunneling, smuggling data inside IPv6 AAAA record lookups to the attacker domain cloudlanecdn[.]com, to refresh the Microsoft Entra ID (Azure AD) credentials it needs to sign in to the Graph channel. It keeps its configuration on disk in a file named logAzure.txt, disguised to look like an ordinary log.
Who is behind it
Group-IB links HOLLOWGRAPH, with high confidence, to a modular backdoor framework it tracks as Cavern, the same toolkit behind a stealthy spy kit aimed at Israeli firms reported earlier this month. Attribution of the operators, though, stays open. The researchers say they cannot confidently tie the activity to any known group, but note technical overlaps with the Iranian nexus actor Lyceum, which they describe as a sub group of OilRig, and rate that link as low confidence. IntelFusions tracks Lyceum as HEXANE. Given the tool's sophistication and its narrow focus on Israel, Group-IB assesses a capable, well resourced adversary.
What defenders should do
Because HOLLOWGRAPH lives inside legitimate Microsoft 365 traffic, network perimeter tools alone will not catch it. Group-IB recommends watching Microsoft Graph and mailbox audit logs for anomalous calendar activity, especially events created, attachments uploaded, or subjects renamed by an application rather than a person. Defenders can also hunt for the malware's tell tale artifacts: calendar events dated to 13 May 2050, subjects that are only a GUID or that read "Event ID:" or "Boss...ID...", and attachments named File{n}.txt. On the identity side, tighten and audit OAuth client credential apps, alert on the creation of new client secrets, and enforce conditional access and credential rotation. On the network, monitor for DNS tunneling, including bursts of unusual AAAA lookups and long, high entropy subdomains, and sinkhole known bad infrastructure.
Indicators of compromise
C2 domain: cloudlanecdn[.]com. File hashes (SHA-256): 75e51774b8f79e5f256eaae639635f911b3e744d4774fd6068dd980255621509, f3f3006f8304788251b153d53b305322b8acab0c66ec816b8d9f101bcc851da3, and b3d0f6e4e3be395fd7cf9e8101c89963d77216578cbb117a6ac9bc3564485eff. On host: a configuration file named logAzure.txt.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.