HOLLOWGRAPH: a Cavern-framework backdoor that turns a compromised Microsoft 365 calendar into a Graph-API dead-drop C2

The HOLLOWGRAPH entry documented an Iran-linked backdoor that used Microsoft Graph and far-future Outlook calendar events as its command-and-control channel. Kaspersky GReAT has now published independent analysis of the same toolset (which Check Point tracks as "Cavern Manticore") detailing a new communication module (AzureCommunication.dll) that replaces the earlier HTTP/WebSocket component with Microsoft Graph, exchanging RSA-OAEP-SHA256 + AES-256-GCM-encrypted commands and results as attachments inside far-future Outlook calendar events (a fixed 2050-05-13 window) keyed to a controller-generated agent ID (Kaspersky, 2026-07-21; Check Point Research, 2026-07-06).

The new element beyond prior reporting is a resilience layer: when Graph authentication or tenant validation fails, the module recovers replacement connection settings (TenantId, ClientId, ClientSecret, UserEmail) via DNS AAAA responses from attacker-controlled nameservers, encoding length markers and 14-byte chunks in specially formatted subdomains. On attribution, Kaspersky retains its low-confidence assessment that Project CAV3RN is associated with OilRig (APT34) (a link it first drew in a previous report) noting the new module shares behavioural patterns with previously reported OilRig tooling (Microsoft-hosted-service C2, attachment-based command exchange, a secondary cloud-C2 recovery mechanism) while explicitly identifying no direct code reuse or infrastructure overlap (Kaspersky, 2026-07-21). Treat the OilRig association as an analytic lead, not a settled attribution.

Kaspersky's GReAT team published a further instalment on Project CAV3RN on 2026-08-11, describing it as "a modular espionage framework used against targets in Israel" and expanding on two earlier publications (Kaspersky Securelist, 2026-08-11). The prior entry here covered the framework's DNS-based C2 fallback and Kaspersky's low-confidence association with OilRig. The delta is a channel-selection design that is worth carrying into detection engineering regardless of who operates it.

Kaspersky states: "The main finding is a complex C2 module that uses DNS A-record responses to choose between direct HTTPS and a Google Apps Script relay for each transaction. The same DNS infrastructure can validate and replace the relay deployment ID, allowing the operator to rotate the Google channel" (Kaspersky Securelist, 2026-08-11). The mechanics are specific enough to hunt on. The communication module is a 64-bit DLL compiled with .NET 8 NativeAOT. Before polling for commands or sending a result, it issues an A-record query for a name built from a short random nonce concatenated with a numeric error state, then a hex-encoded client identifier, under a fixed operator-controlled domain. One exact address is treated as a rejection; otherwise the module reads the fourth octet of the answer and maps it, in combination with the current error state, onto direct HTTPS, the Apps Script relay, an exception, or closing the transaction with no channel at all. A recovered Apps Script deployment ID is written back to the module's on-disk configuration, while other configuration changes pushed by the operator stay in memory. The two channels differ in shape as well as destination. On the direct-HTTPS path the module contacts a configured attacker-controlled address whose endpoint is gated on a custom client-identifier HTTP header, returning a failure response to requests without it and an encoded tasking body to requests carrying it. On the Apps Script path the module instead POSTs a JSON envelope to the deployment URL, with the upstream method and the headers to replay (the same client-identifier value among them) carried as fields inside that JSON body rather than as headers on the request to Google. Tasking comes back base64-encoded and XORed either way.

The second new component is an inter-component broker, a 64-bit Visual C++ DLL that masquerades as the RNP OpenPGP library through a set of rnp_* exports, with one of those exports starting the broker. At startup it creates its control structure, initialises a message dispatcher and scans the host directory for DLLs, grouping candidates by their CompanyName resource and loading the highest-versioned member of each group that exposes four specific named exports. It rescans that directory every second, so a component can be added or upgraded without restarting the host, but only by dropping a higher-versioned DLL under a new path, because replacing a file in place is not detected (Kaspersky Securelist, 2026-08-11).

Triage: high-volume DNS lookups under a single parent domain are also how legitimate telemetry agents, CDN clients and some licence checks behave, so the query volume alone is not the signal. The discriminators the described mechanism supports are the label structure (a short changing nonce plus a stable hex-encoded identifier per host, rather than a service-shaped name) and the tight temporal coupling, with one lookup preceding each outbound connection rather than a periodic refresh independent of traffic. Note what is not available as a discriminator on the relay path: the custom client-identifier travels inside the JSON body of a TLS POST to a legitimate Google endpoint, so it is not visible to header inspection or to anything short of TLS interception at the proxy.