ctipilot.ch

HOLLOWGRAPH

tool · tool:hollowgraph-malware

NativeAOT .NET backdoor Group-IB links with high confidence to the Cavern C2 framework; abuses the Microsoft Graph API to turn a compromised M365 mailbox calendar into a two-way dead-drop (far-future events, hybrid RSA-OAEP + AES-256-GCM attachments) with DNS-tunneled Microsoft Entra ID credential refresh. Narrowly targets Israeli organisations; observed 3 June - 9 July 2026 (Group-IB, 2026-07-20).

Coverage timeline
1
first 2026-07-21 → last 2026-07-21
Peak priority
notable
1 notable
Sources cited
2
2 hosts
Sections touched
1
deep-dive
Co-occurring entities
2
see Related entities below
ATT&CK techniques
5
pinned v19.1 · see below

Hunting pivots

Affected products
Microsoft 365Microsoft Entra IDMicrosoft Graph API

ATT&CK techniques

5 techniques observed across 1 entry — derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.1 · compare on the matrix · Navigator layer (JSON)

Initial Access TA0001

T1078.004Valid Accounts: Cloud Accounts×1

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-07-21/hollowgraph-m365-calendar-graph-api-c2-cavern · ATT&CK page ↗

Persistence TA0003

T1078.004Valid Accounts: Cloud Accounts×1

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-07-21/hollowgraph-m365-calendar-graph-api-c2-cavern · ATT&CK page ↗

Privilege Escalation TA0004

T1078.004Valid Accounts: Cloud Accounts×1

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-07-21/hollowgraph-m365-calendar-graph-api-c2-cavern · ATT&CK page ↗

Stealth TA0005

T1027Obfuscated Files or Information×1

Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.

Evidence: 2026-07-21/hollowgraph-m365-calendar-graph-api-c2-cavern · ATT&CK page ↗

T1078.004Valid Accounts: Cloud Accounts×1

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-07-21/hollowgraph-m365-calendar-graph-api-c2-cavern · ATT&CK page ↗

Command and Control TA0011

T1071.004Application Layer Protocol: DNS×1

Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Evidence: 2026-07-21/hollowgraph-m365-calendar-graph-api-c2-cavern · ATT&CK page ↗

T1102.002Web Service: Bidirectional Communication×1

Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems can then send the output from those commands back over that Web service channel. The return traffic may occur in a variety of ways, depending on the Web service being utilized. For example, the return traffic may take the form of the compromised system posting a comment on a forum, issuing a pull request to development project, updating a document hosted on a Web service, or by sending a Tweet.

Evidence: 2026-07-21/hollowgraph-m365-calendar-graph-api-c2-cavern · ATT&CK page ↗

T1573Encrypted Channel×1

Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.

Evidence: 2026-07-21/hollowgraph-m365-calendar-graph-api-c2-cavern · ATT&CK page ↗

Story timeline

  1. 2026-07-21HOLLOWGRAPH: a Cavern-framework backdoor that turns a compromised Microsoft 365 calendar into a Graph-API dead-drop C2
    deep-diveGroup-IB details HOLLOWGRAPH — a .NET implant using a victim's own M365 calendar as two-way C2 over the Graph API, with DNS-tunneled Entra credential refresh

Relationships explore in graph

Typed, source-stated connections from the entity registry — each edge cites the entry whose reporting establishes it.

variant of

Where this entity is cited

  • deep-dive1

Source distribution

  • group-ib.com1 (50%)
  • infosecurity-magazine.com1 (50%)

Co-occurring entities

Derived — referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Entries about HOLLOWGRAPH (1)

2026-07-21 · view entry permalink →

NOTABLENATOB2

HOLLOWGRAPH: a Cavern-framework backdoor that turns a compromised Microsoft 365 calendar into a Graph-API dead-drop C2

Group-IB has published a technical profile of HOLLOWGRAPH, a NativeAOT-compiled .NET DLL it "attribute[s], with high confidence, to the Cavern backdoor framework" (Group-IB, 2026-07-20) — the modular C2 that Check Point Research previously tied to the Iran-MOIS-linked Cavern Manticore actor and that this pipeline has tracked since 2026-07-09. The interest for defenders is not the actor but the command-and-control design, which is built entirely on trusted Microsoft cloud services and leaves almost no attacker-owned network footprint. Infosecurity Magazine corroborates the reporting (Infosecurity Magazine, 2026-07-20).

HOLLOWGRAPH implements only two operations, get and send, and never beacons to attacker infrastructure. Instead it treats a compromised Microsoft 365 mailbox's calendar as a two-way dead-drop over the Graph API. To exfiltrate, the implant encrypts a file with hybrid RSA-OAEP + AES-256-GCM (separate key pairs per direction), creates a calendar event dated far in the future — 2050-05-13, in a fixed 22:00–23:00 UTC window — so the mailbox owner is unlikely to notice, uploads the ciphertext as event attachments, and renames the event subject to an operator-recognisable tag. To receive tasking, it queries the same calendarView window, filters events by subject, downloads the attachment planted by the operator, and decrypts it. A separate, unencrypted channel refreshes the four Entra ID (Azure AD) values the implant needs — tenant ID, client ID, client secret and target mailbox — by DNS tunneling: length- and data-encoded queries against an attacker domain resolved as IPv6 AAAA records and reassembled into fixed-size chunks.

The kill chain, described for reasoning about detection: the implant authenticates as an application/service identity to Microsoft Graph and drives calendar operations programmatically — the Graph-API calendar dead-drop is bidirectional web-service command-and-control and the credential refresh rides DNS as an application-layer channel; the calendar payloads are encrypted end-to-end; and the implant operates against cloud-account credentials rather than an on-host identity. Group-IB is explicit about the attribution ceiling: it "cannot confidently attribute this activity to any previously identified threat actor," assessing only a low-confidence technical overlap with the Iranian-nexus Lyceum sub-group — so this is a Cavern-framework component, not a confirmed named-actor campaign. Telemetry to date is narrow: 12 infected systems, roughly 3 actively communicating, all evidence pointing to Israeli organisations, with activity observed between 3 June and 9 July 2026.

Group-IB Threat Intelligence team has identified HOLLOWGRAPH, a new malware sample that we attribute, with high confidence, to the Cavern backdoor framework

we cannot confidently attribute this activity to any previously identified threat actor.

Group-IB Threat Intelligence 2026-07-20
threat21 Jul 04:43Zmulti-sourceOpen finding ↗