Affected Systems
Microsoft 365 environments with compromised mailboxes. Threat actors leverage legitimate Microsoft Graph API and calendar features to establish covert command-and-control channels. No specific product vulnerability; relies on compromised credentials or initial access.
Exploitation Status
Active campaign observed. Attackers are using HollowGraph malware in the wild to abuse legitimate Microsoft 365 calendar functionality for C2 communications and data exfiltration. This is a living-off-the-land technique rather than exploitation of a specific CVE.
Business Impact
Organizations using Microsoft 365 face detection challenges as malicious traffic appears as legitimate Graph API calls to calendar services. Traditional network security controls may not flag this activity. Compromised accounts can enable persistent, stealthy C2 channels that blend with normal business operations. Incident response teams must review calendar event logs and Graph API usage patterns to identify anomalous behavior.
Urgency
🟠Within 24 hours
Recommended Actions
- Enable and review Microsoft 365 Unified Audit Logs, specifically monitoring Graph API calls to calendar endpoints (MailboxItemsAccessed, UpdateCalendarEvents) for anomalous patterns
- Implement conditional access policies requiring MFA for all Microsoft 365 accounts and review existing mailbox compromises or suspicious sign-in activity
- Deploy Microsoft Defender for Office 365 or equivalent CASB solution with behavioral analytics to detect unusual calendar API usage patterns
- Hunt for calendar events with suspicious properties: encoded data in subject/body fields, high-frequency automated creation/deletion, or events created by service principals rather than users
- Review and restrict Graph API permissions for applications and service principals to least-privilege access, auditing any apps with Mail.ReadWrite or Calendars.ReadWrite permissions