Overview
- Group-IB disclosed Monday that a newly documented Windows implant called HOLLOWGRAPH uses a compromised Microsoft 365 mailbox and the Graph API to run a two‑way covert channel through calendar events.
- The malware supports only two commands, get and send, and reads operator tasking from calendar event attachments dated 2050‑05‑13 while exfiltrating encrypted files as attachments named in a File{n}.txt pattern.
- HOLLOWGRAPH refreshes its Microsoft Entra ID client credentials by DNS tunnelling through IPv6 AAAA queries to the attacker domain cloudlanecdn[.]com and writes the decoded values to a local file named logAzure.txt.
- All Graph traffic is protected with hybrid RSA plus AES‑256‑GCM encryption using separate RSA key pairs for inbound tasking and outbound exfiltration, and Group‑IB links the implant with high confidence to the Cavern framework.
- Researchers found at least 12 infected systems with about three actively communicating, most indicators point to a narrowly focused espionage campaign against Israeli entities, and defenders are urged to harden OAuth app permissions, monitor Graph and mailbox audit logs, enforce Conditional Access and watch DNS for tunnelling patterns.