HOLLOWGRAPH: a Cavern-framework backdoor that turns a compromised Microsoft 365 calendar into a Graph-API dead-drop C2
Group-IB has published a technical profile of HOLLOWGRAPH, a NativeAOT-compiled .NET DLL it "attribute[s], with high confidence, to the Cavern backdoor framework" (Group-IB, 2026-07-20) — the modular C2 that Check Point Research previously tied to the Iran-MOIS-linked Cavern Manticore actor and that this pipeline has tracked since 2026-07-09. The interest for defenders is not the actor but the command-and-control design, which is built entirely on trusted Microsoft cloud services and leaves almost no attacker-owned network footprint. Infosecurity Magazine corroborates the reporting (Infosecurity Magazine, 2026-07-20).
HOLLOWGRAPH implements only two operations, get and send, and never beacons to attacker infrastructure. Instead it treats a compromised Microsoft 365 mailbox's calendar as a two-way dead-drop over the Graph API. To exfiltrate, the implant encrypts a file with hybrid RSA-OAEP + AES-256-GCM (separate key pairs per direction), creates a calendar event dated far in the future — 2050-05-13, in a fixed 22:00–23:00 UTC window — so the mailbox owner is unlikely to notice, uploads the ciphertext as event attachments, and renames the event subject to an operator-recognisable tag. To receive tasking, it queries the same calendarView window, filters events by subject, downloads the attachment planted by the operator, and decrypts it. A separate, unencrypted channel refreshes the four Entra ID (Azure AD) values the implant needs — tenant ID, client ID, client secret and target mailbox — by DNS tunneling: length- and data-encoded queries against an attacker domain resolved as IPv6 AAAA records and reassembled into fixed-size chunks.
The kill chain, described for reasoning about detection: the implant authenticates as an application/service identity to Microsoft Graph and drives calendar operations programmatically — the Graph-API calendar dead-drop is bidirectional web-service command-and-control and the credential refresh rides DNS as an application-layer channel; the calendar payloads are encrypted end-to-end; and the implant operates against cloud-account credentials rather than an on-host identity. Group-IB is explicit about the attribution ceiling: it "cannot confidently attribute this activity to any previously identified threat actor," assessing only a low-confidence technical overlap with the Iranian-nexus Lyceum sub-group — so this is a Cavern-framework component, not a confirmed named-actor campaign. Telemetry to date is narrow: 12 infected systems, roughly 3 actively communicating, all evidence pointing to Israeli organisations, with activity observed between 3 June and 9 July 2026.
Group-IB Threat Intelligence team has identified HOLLOWGRAPH, a new malware sample that we attribute, with high confidence, to the Cavern backdoor framework
we cannot confidently attribute this activity to any previously identified threat actor.
ATT&CK mapping
5 techniques mapped from the cited reporting · MITRE ATT&CK v19.1
Initial Access TA0001
T1078.004Valid Accounts: Cloud Accounts
Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.
Persistence TA0003
T1078.004Valid Accounts: Cloud Accounts
Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.
Privilege Escalation TA0004
T1078.004Valid Accounts: Cloud Accounts
Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.
Stealth TA0005
T1027Obfuscated Files or Information
Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
T1078.004Valid Accounts: Cloud Accounts
Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.
Command and Control TA0011
T1071.004Application Layer Protocol: DNS
Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
T1102.002Web Service: Bidirectional Communication
Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems can then send the output from those commands back over that Web service channel. The return traffic may occur in a variety of ways, depending on the Web service being utilized. For example, the return traffic may take the form of the compromised system posting a comment on a forum, issuing a pull request to development project, updating a document hosted on a Web service, or by sending a Tweet.
T1573Encrypted Channel
Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.