HollowGraph hides commands and stolen files in Microsoft 365 calendar events

Group-IB detailed HollowGraph, a Windows implant that uses the calendar of a compromised Microsoft 365 mailbox as a two-way dead drop rather than contacting an attacker-owned server. Authenticating to the Microsoft Graph API with hard-coded tenant, client, and secret values stored in a file named to look like a log, it reads tasking from attachments on calendar events buried at a date in 2050, and exfiltrates by creating its own far-future events with encrypted attachments. A separate DNS tunnel refreshes its credentials. Because the traffic is genuine Graph activity, there is no vulnerability to patch and network controls keyed to attacker infrastructure see nothing.

Check

Hunt Microsoft 365 audit logs for calendar events dated far in the future and for automated calendar and attachment access by service principals rather than interactive users.

Affected

Microsoft 365 organizations where an account or registered application is compromised; the implant blends command and control into legitimate Graph API traffic, so perimeter controls and destination-based blocking do not see it.

Fix

Restrict and audit which client-credential applications can reach Graph, alert on newly created client secrets, monitor mailbox audit logs for anomalous calendar operations, and watch endpoints for the campaign's known artifacts.