A new malicious component, dubbed HollowGraph, has been identified using Microsoft 365 mailboxes, specifically their calendar features, as a covert command-and-control (C2) channel. This module is believed to be part of the Cavern C2 framework, which has previously been associated with an Iranian threat actor targeting entities in Israel.
HollowGraph leverages the Microsoft Graph API for its primary communication, authenticating with hardcoded details from a compromised Microsoft 365 account. These details, including the Microsoft Entra ID tenant ID, application (client) ID, client secret, target mailbox address, C2 domain, and two RSA keys, are stored in a configuration file named `logAzure.txt`, designed to mimic a legitimate log file. The RSA keys facilitate a hybrid encryption scheme, combining RSA and AES-256-GCM algorithms, to secure both inbound and outbound communications over Microsoft Graph.
The malware uses the mailbox calendar as a dead-drop mechanism. It creates calendar events dated May 13, 2050, with specific title formats. Commands from the attacker and exfiltrated data are concealed within files attached to these calendar entries. HollowGraph is programmed to retrieve commands from events scheduled within a fixed one-hour window between 22:00 and 23:00 UTC on May 13, 2050. It supports two main commands: `GET`, to search for entries with a specific ID format and decrypt instructions, and `SEND`, to create new calendar entries with encrypted stolen data.
In addition to the encrypted Microsoft Graph channel, HollowGraph maintains a secondary, unencrypted communication channel via DNS tunneling. This channel is used to receive updated Microsoft Entra ID credentials (tenantId, clientId, clientSecret, and mailbox) for authentication to Microsoft Graph. It retrieves these values through IPv6 AAAA record queries to the attacker-controlled domain `cloudlanecdn[.]com`, subsequently updating the `logAzure.txt` configuration file. Each 16-byte IPv6 address provides 14 usable payload bytes, which the malware assembles into UTF-8 text for configuration updates.
At least 12 systems have been infected with HollowGraph, with three actively communicating with the threat actor between June 3 and July 9. The targeting appears focused on organizations in Israel, suggesting an espionage motive. While researchers have noted technical similarities between HollowGraph and the Iranian-nexus threat actor Lyceum, there is currently insufficient evidence for a high-confidence attribution to Lyceum. However, the link to the Cavern framework is assessed with high confidence.
The sophisticated nature of HollowGraph, including its use of trusted cloud infrastructure for C2, hybrid encryption, DNS tunneling for credential refresh, and highly selective targeting, indicates significant technical capabilities and operational maturity on the part of the threat actor.
Organizations are advised to monitor Microsoft Graph and Microsoft 365 audit logs for suspicious application-driven calendar activity, especially events scheduled far into the future or those with unusual subjects and attachments. Specific indicators of compromise include the `cloudlanecdn[.]com` domain and the `logAzure.txt` file. Implementing Conditional Access, restricting and auditing OAuth client-credential applications, and monitoring outbound DNS for tunneling patterns are also recommended security measures.
