400/69 Wednesday, July 22, 2026
Cybersecurity firm Group-IB has reported the discovery of a new malware strain called HollowGraph, which uses the Calendar feature in compromised Microsoft 365 accounts as a communication channel with command-and-control (C2) servers to receive commands and exfiltrate stolen data. Researchers assess that it is part of the Cavern framework, which has previously been linked to Iranian threat actors targeting organizations in Israel. At least 12 systems have been found infected, with three systems continuing to communicate with the attackers between June 3 and July 9, indicating a targeted espionage operation.
Analysis of the attack technique found that components of the attackers’ framework load malicious DLL files disguised as Brotli libraries to act as implants on the target system. The malware then uses credentials hidden in a file named logAzure.txt to access the Microsoft Graph API. The main technique involves the attackers creating calendar events scheduled far into the future, up to May 13, 2050, to serve as hidden storage locations. Commands and stolen data are attached to these calendar events and protected using hybrid encryption. In addition, HollowGraph has a backup communication channel through DNS tunneling, sending requests to an attacker-controlled domain, cloudlanecdn.com, to continuously retrieve updated Microsoft Entra ID account information. This allows the malware to maintain connectivity and exfiltrate data stealthily.
To reduce risk and prevent attacks, administrators should closely monitor Microsoft Graph and Microsoft 365 activity logs, focusing on unusual calendar event creation, especially events scheduled unusually far into the future, suspicious event titles, or abnormal attachments. Administrators should also inspect network connections for indicators of compromise (IOCs), such as connections to cloudlanecdn[.]com and the presence of the logAzure.txt file on systems. Organizations should enforce conditional access policies, strictly control permissions, review applications using OAuth authentication, and monitor outbound DNS traffic to detect and prevent data exfiltration in a timely manner.