Actor Profile

HollowGraph is a newly discovered espionage-focused malware family that employs a novel command and control mechanism leveraging compromised Microsoft 365 calendar infrastructure. The malware was identified and analyzed by Group-IB. Attribution to a specific threat actor or nation-state sponsor has not been publicly disclosed. The implant demonstrates sophisticated operational security by abusing legitimate cloud services for C2 communications, suggesting development by an actor with advanced technical capabilities and a focus on long-term persistence and stealth in targeted environments.

TTPs (Tactics, Techniques, Procedures)

HollowGraph employs several notable techniques for command and control and defense evasion. The malware leverages the Microsoft Graph API to communicate with compromised Microsoft 365 calendar accounts, hiding operator commands and exfiltrated data within calendar event entries. To further obfuscate malicious activity, events are scheduled far into the future (year 2050), reducing the likelihood of user detection. By utilizing legitimate Microsoft Graph API traffic patterns, HollowGraph blends C2 communications with normal enterprise cloud service usage, evading network-based detection mechanisms. This approach aligns with MITRE ATT&CK techniques including T1071.001 (Application Layer Protocol: Web Protocols), T1102 (Web Service), and T1567.002 (Exfiltration Over Web Service: Exfiltration to Cloud Storage).

Targets & Patterns

Specific targeted sectors and geographic regions have not been disclosed in available reporting. However, the use of Microsoft 365 infrastructure as a C2 channel suggests the malware is designed to target organizations with enterprise Microsoft cloud deployments. The espionage-focused nature of HollowGraph indicates targeting of entities with valuable intellectual property, sensitive communications, or strategic intelligence value. The sophisticated evasion techniques employed suggest selective targeting rather than opportunistic mass compromise, consistent with advanced persistent threat operations focused on intelligence collection and long-term access maintenance.

Historical Context

HollowGraph represents an evolution in adversary abuse of legitimate cloud services for command and control. Previous malware families have leveraged platforms such as GitHub, Pastebin, Twitter, and cloud storage services for C2, but the specific abuse of Microsoft 365 calendar infrastructure represents a novel approach. The technique builds on the broader trend of "living off the land" and "living off trusted sites" methodologies, where attackers leverage legitimate enterprise services to evade detection. This campaign appears to be newly identified with no publicly documented connection to previous operations or known APT groups at this time.

Defensive Recommendations

  • Monitor Microsoft Graph API usage for anomalous patterns, including calendar operations with events scheduled to unusual future dates (e.g., year 2050 or beyond)
  • Implement conditional access policies and OAuth application governance to detect and restrict unauthorized third-party applications accessing Microsoft 365 calendars
  • Enable Microsoft 365 unified audit logging and alert on suspicious calendar event creation, modification, or access patterns, particularly those involving service accounts or non-interactive logins
  • Deploy network monitoring to identify unusual volumes of Graph API traffic or calendar synchronization activity from endpoints, especially outside normal business hours
  • Conduct regular reviews of OAuth grants and application permissions within Microsoft 365 environments to identify potentially compromised accounts or malicious applications with calendar access