A newly discovered Windows malware, dubbed HollowGraph, has been identified as abusing the Microsoft Graph API to establish a covert two-way command and control (C2) channel through compromised Microsoft 365 calendars. Cybersecurity researchers at Group-IB, who named the sophisticated malware, have attributed it with high confidence to the Cavern backdoor framework.
Analysis by Group-IB indicates that HollowGraph attacks are highly targeted, primarily focusing on entities in Israel. This assessment is based on the identification of a compromised mailbox linked to an Israeli organization, as well as the origin of malware files and associated Cavern framework components, all uploaded from Israel.
The researchers observed 12 systems infected with HollowGraph malware, with the earliest recorded communication between a victim and an attacker occurring on June 3, 2026. The most recent instance was detected on July 9, 2026. The limited number of identified victims suggests a highly targeted operation rather than an opportunistic campaign.
While a definitive attribution to a specific threat actor remains unconfirmed, Group-IB noted several technical similarities with Lyceum, an Iranian-nexus threat actor known for espionage activities. The sophistication of HollowGraph, combined with its precise targeting of Israeli entities, points to a well-resourced and capable adversary.
HollowGraph employs trusted Microsoft services to evade detection, supporting "get" and "send" commands. It relies entirely on legitimate third-party infrastructure for communication, avoiding direct connections to attacker-controlled servers for payload delivery. The "send" command generates calendar appointments with encrypted stolen files attached, while the "get" command searches for operator-planted appointments and downloads attached instructions.
For authentication to the Graph channel, HollowGraph uses DNS tunneling to deliver and refresh Microsoft Entra ID (Azure AD) credentials. This channel itself is not encrypted. However, Graph communications are secured using a hybrid encryption scheme involving RSA and AES-256-GCM, with distinct RSA key pairs for inbound and outbound traffic.
Group-IB highlighted several technical characteristics that strongly suggest HollowGraph is part of the Cavern framework and its broader toolkit. These include a matching command format, where the component is invoked with the string format `command_;;_arg0_,_arg1_,_arg2`. This syntax aligns with Cavern's command structure.
Attackers issued commands such as `MzU=`, which decodes to `003`, an instruction classified as an agent self-command for the Cavern malware, used for toggling debug logging. The observed tasking from the C2 server also mirrors Cavern's format, exemplified by `{ cid : oXhLaJ0ZvtPb9XB , type : self , cmd : 003_;;__,_ }`. These technical details led Group-IB to conclude that HollowGraph represents a variant within the Cavern framework.
Organizations are advised to actively hunt for indicators associated with HollowGraph and to monitor Microsoft Graph API activity and Microsoft 365 mailbox audit logs for anomalous calendar operations. Such operations include event creation, attachment uploads, and subject changes initiated by an application rather than a user.
