Calendar Events Weaponized for Data Exfiltration
Malicious actors are hijacking Microsoft 365 mailboxes with a new malicious component dubbed HollowGraph, transforming routine calendar features into a covert command-and-control channel. Research from Group-IB reveals that the malware embeds encrypted instructions within calendar event attachments to facilitate data exfiltration and task execution.
The Mechanics of a Dead-Drop
HollowGraph authenticates to the Microsoft Graph API using hardcoded credentials—including the tenant ID, application client ID, client secret, and mailbox address—stolen from compromised accounts. These credentials are tucked away in a local configuration file disguised as a standard log file, logAzure.txt.
To mask their movements, attackers create calendar entries dated May 13, 2050, serving as a “dead-drop” for instructions. The malware relies on two primary commands: a GET function to download and decrypt instructions from specific event IDs, and a SEND function that attaches stolen data to new calendar entries, encrypted via a public RSA key. Group-IB reports the malware employs a hybrid encryption scheme, mixing RSA and AES-256-GCM to keep communications invisible to standard monitoring tools.
Resilient Dual-Channel Communication
HollowGraph does not rely solely on the calendar. It maintains a secondary, unencrypted path via DNS tunneling by performing IPv6 AAAA record queries to cloudlanecdn[.]com. By reassembling 14-byte chunks from these queries, the malware updates its own configuration, allowing attackers to rotate Entra ID credentials or mailbox targets on the fly. This dual-channel architecture ensures the operation remains both functional and resilient.
Tracing the Iranian-Nexus Connection
While definitive attribution is complex, Group-IB identified technical parallels between HollowGraph and the Lyceum threat actor, an Iranian-nexus actor historically linked to attacks against Israeli entities. Researchers tied the malware to the broader Cavern C2 framework, though they stopped short of a direct identity match. At least 12 systems have been infected, with three showing active communication between June 3 and July 9. The targeting pattern points toward an espionage campaign focused on specific organizations within Israel.
Securing the Microsoft 365 Environment
Security teams should immediately audit Microsoft 365 logs for anomalous application-driven calendar activity. To defend against this threat, organizations must:
- Audit OAuth Applications: Restrict and monitor OAuth client-credential applications to prevent unauthorized Microsoft Graph access.
- Monitor DNS Traffic: Inspect outbound DNS traffic for tunneling patterns, specifically queries directed at
cloudlanecdn[.]com. - Enforce Conditional Access: Implement strict Conditional Access policies to limit the scope of compromised credentials.
- Review Calendar Activity: Investigate calendar entries with suspicious subjects, attachments, or future-dated timestamps.
Worth a look