Back Feeds.4Sysops

HollowGraph hides espionage C2 in Microsoft 365 calendars set for 2050

Feeds.4Sysops •IT News • July 20, 2026

Group-IB researchers identified HOLLOWGRAPH, a lean Windows .NET malware that hijacks a compromised Microsoft 365 account and abuses the Microsoft Graph API to turn its calendar into a covert two-way dead drop. Instead of contacting attacker infrastructure, the implant retrieves encrypted tasking from event attachments via a "get" command and exfiltrates stolen files by creating new events with encrypted attachments via a "send" command. All such events are deliberately scheduled for May 13, 2050 so legitimate users are unlikely to notice them, and traffic blends into ordinary Graph API calls. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

HOLLOWGRAPH Malware Exploits Microsoft 365 Calendars for Espionage Group-IB has identified HOLLOWGRAPH, a sophisticated Windows malware that abuses the Microsoft Graph API to covertly exfiltrate files and receive commands through compromised Microsoft 365 calendar events. The malware operates by creating calendar appointments dated far into the future, specifically May 13, 2050, to avoid detection. It has been linked to the Cavern backdoor framework and is primarily targeting Israeli entities, with 12 confirmed infections. The malware employs DNS tunneling for credential renewal and uses hybrid RSA and AES encryption for secure communications. The attack method is highly targeted, suggesting a well-resourced adversary, potentially linked to Iranian threat actors. The first observed communication occurred on June 3, 2026, with the latest on July 9, 2026. 10 sources 75

Extracted Entities

HollowGraph hides espionage C2 in Microsoft 365 calendars set for 2050

The full story

Extracted Entities

Attack Types (2)

Malware (1)

MITRE ATT&CK (3)

Platforms (1)