🎯 Threat Intelligence
Group-IB Threat Intelligence has identified HOLLOWGRAPH, a .NET NativeAOT-compiled DLL malware attributed with high confidence to the Cavern backdoor framework. The malware transforms Microsoft 365 calendars into covert command-and-control channels using the Microsoft Graph API, communicating through a compromised Israeli mailbox.
🔹 Technical Overview
HOLLOWGRAPH operates with only two commands: get and send. Both execute exclusively through trusted Microsoft cloud infrastructure. The malware never reaches out directly to attacker-owned servers. Instead, it uses the Microsoft Graph API to treat a compromised mailbox's calendar as a two-way dead-drop.
🔹 C2 Mechanism
The calendar-based C2 works as follows:
- Tasking: Operators plant calendar events containing encrypted commands as attachments.
- Exfiltration: The implant creates its own calendar events with encrypted stolen data attached as files.
- Concealment: Every event is dated to 13 May 2050, ensuring the mailbox owner is unlikely to notice them.
All Graph payloads use hybrid RSA + AES encryption. Two separate key pairs keep tasking and exfiltration channels cryptographically independent.
🔹 Credential Renewal Channel
HOLLOWGRAPH maintains a secondary communication channel through DNS tunneling. It performs IPv6 AAAA record queries against the attacker-controlled domain cloudlanecdn[.]com to refresh its Microsoft Entra ID (Azure AD) credentials. Updated values are written to an on-disk configuration file named logAzure.txt.
This dual-channel architecture provides resilience. Even if the primary Graph API channel is disrupted, the malware can continue receiving refreshed authentication tokens through DNS.
🔹 Victimology
Group-IB identified 12 systems carrying the implant. Only approximately three were actively communicating with attacker infrastructure. The recovered indicators, an Israeli mailbox used for exfiltration and malware samples uploaded from Israel, suggest focused interest in Israeli entities rather than broad opportunistic compromise.
🔹 Detection Considerations
Defenders monitoring Microsoft 365 environments should look for:
• Calendar events with future dates far beyond typical scheduling horizons (e.g., 2050)
• Unusual file attachments on calendar entries
• DNS queries to cloudlanecdn[.]com with AAAA record types
• The on-disk artifact logAzure.txt
• Authentication patterns from .NET NativeAOT binaries interacting with Microsoft Graph API
🔹 Attribution
Group-IB links HOLLOWGRAPH to the Cavern backdoor framework with high confidence, based on code and behavioral similarities with known Cavern components.
🔹 HOLLOWGRAPH #ThreatIntelligence #C2 #Microsoft365 #MalwareAnalysis
🔗 Source: https://www.group-ib.com/blog/hollowgraph-microsoft-365/
