Fast Facts
- A stealthy espionage implant, HollowGraph, uses hijacked Microsoft 365 calendars with far-future dates (e.g., 2050-05-13) for command and data exfiltration, wrapped in strong encryption, making detection difficult.
- Attackers leverage legitimate Microsoft Graph API traffic and DNS DNS queries to maintain persistence and secret communication, avoiding software vulnerabilities or patches.
- Detection requires monitoring for unusual calendar events, attachments named FileDiscover More Technology Insights.txt, and suspicious DNS AAAA lookups, emphasizing identity management and activity audit over software fixes.
The Threat, Attack Techniques, and Targets
The HollowGraph malware uses a new way to hide its commands and stolen files. It hijacks Microsoft 365 calendars to communicate with the attacker. The malware is a small .NET DLL. It supports only two commands: get and send. The malware never talks directly to the attacker’s server. Instead, it uses calendar events and attachments to exchange information.
The attacker plants a calendar event with a far-future date, which is usually unnoticed. They attach an instruction file for the malware to read. When stealing data, the malware encrypts files, creates a new event with a future date, and attaches the stolen data. All data is encrypted with RSA and AES-256, making it hard to detect without special tools.
There is also a second channel that keeps the malware active. It uses DNS to refresh login details by decoding IPv6 AAAA records from a malicious domain. This information is stored in a log file and helps maintain access.
The targets are mainly organizations with Microsoft 365 mailboxes. The malware has been found on at least 12 computers, with some actively communicating with the attacker. The activity appears to be targeted espionage, not widespread crime.
Impact, Security Implications, and Remediation Guidance
This malware can steal sensitive data and hide command activity within Microsoft 365 services. Because it uses legitimate functions like calendar events and Graph API traffic, detection is difficult. The attack method is reliant on compromised accounts and normal API use, not software vulnerabilities.
The main security risk is that it can go unnoticed in regular activity and persist for long periods. If organizations do not monitor calendar events and API activity closely, they might miss signs of infiltration.
There is no specific software patch needed. Since the malware exploits existing account permissions and features, the focus should be on strong identity management. Organizations should restrict and review OAuth app permissions, monitor for unusual calendar activities, and alert on new client secrets. Regular credential rotation and conditional access policies are recommended.
For detection, monitor calendar events for future dates, GUIDs, or suspicious attachment names. Also, check DNS for high-frequency AAAA queries towards unusual domains like “cloudlanecdn.com.” Full details and indicators, including file hashes, are available through security reports and should be obtained from the relevant security authorities or vendors.
Learn how the Internet of Things (IoT) is transforming everyday life.
Explore past and present digital transformations on the Internet Archive.
Explore past and present digital transformations on the Internet Archive.
ThreatIntel-V1
