Graph API command-and-control abuse

Group-IB uncovers HOLLOWGRAPH, a Windows malware that abuses Microsoft Graph API to exfiltrate files and receive commands from the attacker using Microsoft 365 calendar events, and DNS tunneling to refresh credentials used in C2 communication.

The Group-IB Threat Intelligence team has identified HOLLOWGRAPH, a new malware sample that we attribute, with high confidence, to the Cavern backdoor framework . This malware is one component of a larger toolkit, and it uses the Microsoft Graph API through a compromised Microsoft 365 account observed in Israel to communicate with its operators — a technique that helps conceal command-and-control traffic within legitimate Microsoft 365 communications.

The malware supports just two commands, get and send, and executes both exclusively through trusted Microsoft cloud infrastructure. Using the Microsoft Graph API, it treats the compromised mailbox’s calendar as a two-way dead-drop: operators plant tasking as calendar events, and the implant exfiltrates stolen files by creating its own events with encrypted data attached. To avoid catching the mailbox owner’s attention, every event is dated far into the future — 13 May 2050 — with payloads attached as files to the event.

A second channel handles credentials renewal. The malware performs DNS tunneling — using IPv6 AAAA record queries against the attacker-controlled domain “cloudlanecdn[.]com” — to refresh the Microsoft Entra ID (Azure AD) credentials it authenticates with, writing the updated values to an on-disk configuration file (logAzure.txt).

All Graph payloads are secured with hybrid RSA + AES encryption, using two separate key pairs so that tasking and exfiltration remain cryptographically independent of each other.

We identified 12 victims carrying the implant, of which only three were actively communicating with the attacker. The recovered indicators — an Israeli mailbox used for exfiltration and malware samples uploaded from Israel — suggest a focused interest in Israeli entities rather than broad, opportunistic compromise.

Group-IB customers can access our Threat Intelligence portal for more information this malware : HOLLOWGRAPH

HOLLOWGRAPH is a .NET NativeAOT-compiled DLL. It operates as a two-command malware and linked to the Cavern C2 framework , leveraging trusted Microsoft cloud infrastructure (specifically the Microsoft Graph API) to receive commands and exfiltrate files through a compromised Microsoft 365 mailbox calendar.. This approach allows it to blend into normal enterprise network traffic making malicious communications significantly harder to distinguish from legitimate Microsoft 365 traffic..

The malware supports two commands — get and send — and relies entirely on trusted third-party infrastructure for communication, never reaching out directly to attacker-owned servers for payload delivery:

Figure 1. HOLLOWGRAPH command-and-control communication.

Purpose : Download the operator’s command from the mailbox calendar dead-drop and decrypt it using the RSA private key in the configuration.

Purpose : Encrypt data supplied by the loader using the public RSA key stored in the configuration and upload it to the same mailbox calendar.

2. Attach the encrypted files — Each file chunk is uploaded via POST /users/{mailbox}/calendar/events/{eventId}/attachments , encoded in base64 as an application/octet-stream attachment.

3. Rename the event — A final PATCH /users/{mailbox}/calendar/events/{eventId} call updates the subject line to an operator-recognizable tag following the Boss{…}ID{…} naming convention.

This channel refreshes four Microsoft Entra ID credentials — tenantId, clientId, clientSecret, and mailbox — by querying the attacker’s-controlled domain cloudlanecdn[.]com .

The binary contains an embedded, hardcoded configuration that includes the Microsoft Entra ID tenant ID, application (client) ID, client secret, target mailbox address, command-and-control (C2) domain, and two RSA keys (Public key to encrypt exfiltrated files and private key to decrypt tasks send from attacker). Upon execution, this configuration is written to disk as a file named logAzure.txt, disguised to resemble an ordinary log file.

Figure 2 . Embedded HOLLOWGRAPH configuration table.

Several technical characteristics strongly suggest that HOLLOWGRAPH— and the broader toolkit of which is it part — is a variant of the Cavern Framework.

Taken together, these similarities strongly support our assessment that HOLLOWGRAPH is part of a different variant of the Cavern framework.

Our analysis indicates that this attack is highly targeted and focuses on Israeli entities. This assessment is based on several observations:

In total, Group-IB identified at least 12 systems infected with HOLLOWGRAPH. The earliest observed communication between a victim and the attacker occurred on 3 June 2026, while the most recent was observed on 9 July 2026, indicating that the malware has been actively used since at least early June 2026. The relatively small number of identified victims suggests that the operation is highly targeted rather than opportunistic. Of the 12 identified infections, only three were actively communicating with the attacker during the observation period. This selective interaction reflects a disciplined operational approach and suggests that the threat actor is deliberately engaging only with intended targets.

Figure 3. Observed victims communication activity by HOLLOWGRAPH Agent ID.

Figure 4. First and last observed victim communications with the attacker.

HOLLOWGRAPH demonstrates a high level of technical sophistication. Its use of trusted cloud infrastructure for command-and-control, hybrid encryption, DNS tunneling for credential refresh, and highly selective victim targeting collectively suggest that the threat actor possesses significant technical capabilities and operational maturity.

Based on the evidence currently available, we cannot confidently attribute this activity to any previously identified threat actor. However, our analysis identified several technical similarities with the Iranian-nexus threat actor Lyceum. While these overlaps are noteworthy, they are not sufficiently unique to support a high-confidence attribution. At this stage, we assess a potential link to Lyceum with low confidence.

Our analysis indicates that the Cavern framework shares several technical characteristics with malware previously attributed to Lyceum.Cavern’s modular backdoor functionality closely resembles a .NET backdoor used by Lyceum in early 2025 (SHA-256: 315bdba98c6fe863d39f6afccc727e17d5aea63bf21259444fa988cae56d61c1). This Lyceum .net modular backdoor shares the same commands and command codes as the .NET TCP backdoor described in this report (hash: 1573e125197ec77d8e9930c611ba2802ee59e19629396b5e99b426b46c53bd25), and it likewise keeps all modules on disk and loads them on demand. It also treats every received command as a plugin name, concatenating the command number with CLD and loading the corresponding DLL from disk — mirroring Cavern’s behavior of treating any non-self command as a plugin DLL name.

Figure 5. Table Comparison of the Cavern Framework and the Lyceum Backdoor.

HOLLOWGRAPH represents an advanced and highly targeted espionage threat. By abusing trusted Microsoft 365 calendars through the Microsoft Graph API and refreshing its cloud authentication credentials through DNS tunneling, the malware conceals its command-and-control within legitimate Microsoft 365 and network traffic, evading conventional perimeter defenses. While Group-IB links HOLLOWGRAPH to the Cavern framework with high confidence and has identified tradecraft similarities with Iranian-nexus activity, the threat actor behind this campaign remains unknown at this time. The sophistication of the malware, combined with the disciplined, narrowly scoped targeting of Israeli entities, points to a capable and well-resourced adversary.

The Group-IB Threat Intelligence team will continue to monitor this activity and track the evolution of the Cavern framework in order to provide actionable intelligence that helps organizations anticipate emerging threats and strengthen their cyber resilience.

Based on these findings, Group-IB recommends that organizations strengthen cloud visibility, proactively monitor for abuse of trusted services, and continuously validate their security controls against similar attack techniques.

DISCLAIMER: All technical information, including malware analysis, indicators of compromise and infrastructure details provided in this publication, is shared solely for defensive cybersecurity and research purposes. Group-IB does not endorse or permit any unauthorized or offensive use of the information contained herein. The data and conclusions represent Group-IB’s analytical assessment based on available evidence and are intended to help organizations detect, prevent, and respond to cyber threats.

Group-IB expressly disclaims liability for any misuse of the information provided. Organizations and readers are encouraged to apply this intelligence responsibly and in compliance with all applicable laws and regulations.

This blog may reference legitimate third-party services such as Microsoft 365 and others, solely to illustrate cases where threat actors have abused or misused these platforms.

This material is provided for informational purposes, prepared by Group-IB as part of its own analytical investigation, and reflects recently identified threat activity.

All trademarks referenced herein are the property of their respective owners and are used solely for informational purposes, without any implication of affiliation or sponsorship.