Researchers Discover HOLLOWGRAPH Malware Abusing Microsoft 365, Graph API

Group-IB researchers have discovered HOLLOWGRAPH, a sophisticated malware linked with high confidence to the Cavern cyber-espionage framework. The malware abuses legitimate Microsoft 365 services to conceal its command-and-control (C2) communications.

According to Group-IB researchers, HOLLOWGRAPH leverages the Microsoft Graph API to interact with a compromised Microsoft 365 mailbox. Attackers place commands inside calendar events, and the malware sends stolen data back by creating its own calendar events with encrypted attachments. These events are scheduled for future (May 13, 2050) to avoid attracting attention from the mailbox owner.

Specifically, HOLLOWGRAPH is designed with two primary capabilities, including retrieving commands and exfiltrating data. The get function allows the malware to collect instructions hidden within attacker-created Microsoft 365 calendar events, and its send function uploads stolen information as encrypted attachments to new calendar events.

HOLLOWGRAPH relies entirely on legitimate Microsoft cloud services and the Microsoft Graph API for these operations to disguise its malicious activity within normal organizational traffic. This makes it significantly more difficult for security teams to identify and detect.

DNS tunneling supports credential retrieval from Microsoft Entra ID

HOLLOWGRAPH uses DNS tunneling to obtain and refresh credentials required for accessing Microsoft Entra ID (formerly Azure AD). This secondary channel queries an attacker-controlled domain to receive updated authentication information.

“File payloads are protected with hybrid RSA-OAEP + AES-256-GCM encryption, using separate keys for the inbound (decrypt tasking) and outbound (encrypt exfil) directions,” Group-IB researchers explained.

Group-IB identified 12 compromised systems carrying the HOLLOWGRAPH malware, but only about three victims were actively communicating with the attackers’ infrastructure. The analysis of the compromised Microsoft 365 mailbox and other telemetry data indicates that the operation was primarily focused on Israeli organizations. It suggests a targeted cyber-espionage campaign aimed at specific entities rather than a large-scale cybercrime effort.

How organizations can detect and defend against HOLLOWGRAPH?

Security teams should closely monitor Microsoft 365 environments for unusual activity, including unexpected calendar events, suspicious use of the Microsoft Graph API, and abnormal access patterns involving service accounts or mailboxes. They must also implement multi-factor authentication, regularly review application permissions, and enforce the principle of least privilege to prevent attackers from gaining or maintaining access to cloud resources.

Additionally, security teams should ensure that endpoint detection and response (EDR) solutions are deployed to identify malicious processes attempting to interact with cloud services. They should also strengthen visibility into DNS traffic and cloud authentication activity.

It’s highly recommended to conduct regular threat hunting, log analysis, and monitoring for unusual communications with cloud services to identify stealthy attacks that bypass traditional network-based detection methods. Organizations should also ensure security awareness training, timely patch management, and incident response planning.