Actor Profile

HollowGraph is a newly discovered espionage implant that leverages Microsoft 365 calendar infrastructure for command and control operations. The malware was identified and analyzed by Group-IB. The threat actor behind HollowGraph remains unattributed at this time. The malware's design demonstrates sophisticated operational security by abusing legitimate Microsoft Graph API traffic, making detection significantly more challenging. The use of calendar events dated to 2050 for hiding commands and exfiltrated data indicates deliberate OPSEC considerations to avoid interference with legitimate calendar usage.

TTPs (Tactics, Techniques, Procedures)

HollowGraph employs living-off-the-land techniques by abusing legitimate Microsoft Graph API functionality for command and control (T1071.001 - Application Layer Protocol: Web Protocols). The malware uses Microsoft 365 calendar events as a covert channel, storing operator instructions and exfiltrated data within calendar entries dated to the year 2050 to avoid detection. This technique aligns with T1102 (Web Service) as the malware leverages existing cloud services for C2 communications. The abuse of legitimate API traffic provides strong evasion capabilities (T1027 - Obfuscated Files or Information, T1562.001 - Impair Defenses: Disable or Modify Tools) by blending malicious activity with normal enterprise Microsoft 365 usage patterns.

Targets & Patterns

Specific targeted sectors and geographic regions have not been disclosed in available reporting. However, the choice of Microsoft 365 as the C2 infrastructure strongly suggests targeting of organizations with enterprise Microsoft cloud deployments. The espionage-focused nature of the implant indicates likely targeting of organizations with valuable intellectual property, sensitive communications, or strategic intelligence value. The sophistication of the technique suggests targeting of entities with mature security monitoring capabilities that the actor seeks to evade through living-off-the-land methods.

Historical Context

HollowGraph represents an evolution in adversary abuse of legitimate cloud services for command and control. This technique follows a broader trend of threat actors leveraging trusted platforms such as GitHub, Dropbox, Google Drive, and other cloud services to evade network-based detection. The use of Microsoft 365 calendars specifically is a novel approach that builds on previous research into covert channels within collaboration platforms. No direct links to previous campaigns or known threat actor groups have been publicly established at this time.

Defensive Recommendations

  • Monitor Microsoft Graph API usage for anomalous patterns, including calendar operations with unusual date ranges (e.g., events created far in the future like 2050) or high-frequency calendar modifications by service accounts or non-interactive logins
  • Implement conditional access policies and OAuth application governance to restrict which applications can access Microsoft 365 calendar data and enforce least-privilege principles for Graph API permissions
  • Enable Microsoft 365 audit logging and create detection rules for suspicious calendar event creation, modification, or deletion patterns, particularly events with large attachments or encoded content in event descriptions
  • Deploy endpoint detection capabilities to identify processes making unexpected Microsoft Graph API calls, especially those originating from non-standard applications or system processes
  • Conduct regular reviews of OAuth application permissions and service principal activity within Azure AD/Entra ID to identify unauthorized or suspicious applications with calendar access rights