A new malware component, dubbed HollowGraph, has been discovered to use the calendar feature in compromised Microsoft 365 mailboxes as a command-and-control (C2) channel. Researchers analyzing the module believe it is part of the Cavern command-and-control framework that has been previously linked to an Iranian threat actor targeting entities in Israel.
According to Group-IB’s analysis, HollowGraph uses hardcoded details to authenticate to the Microsoft Graph API via a compromised Microsoft 365 account. The configuration file is stored as `logAzure.txt` to appear as a regular log file and includes sensitive information such as the Microsoft Entra ID tenant ID, application (client) ID, client secret, target mailbox address, C2 domain, and two RSA keys.
The malware uses a hybrid encryption scheme that mixes RSA and AES-256-GCM algorithms to secure communication over Microsoft Graph. It also has a second, unencrypted communication channel through DNS tunnelling, which is used to receive new Microsoft Entra ID details to authenticate to Microsoft Graph.
Researchers have identified at least 12 systems infected with HollowGraph, with three actively communicating with the threat actor between June 3 and July 9. The collected indicators suggest that the threat actor is focused on organizations in Israel, pointing to a targeted attack for espionage purposes.
Group-IB describes the mailbox calendar as a “covert dead-drop,” with HollowGraph retrieving commands from events scheduled within a fixed one-hour window between 22:00 and 23:00 UTC on May 13, 2050. The threat actor uses a highly selective targeting approach, suggesting significant technical capabilities and operational maturity.
To remain under the radar, the threat actor creates calendar events dated May 13, 2050, with titles in specific formats. Commands and exfiltrated data are concealed within files attached to these calendar entries. HollowGraph supports only two commands: GET, to search for entries in a specific format and download instructions; and SEND, to create a calendar entry and attach stolen data encrypted with the public RSA key.
Organizations are advised to monitor Microsoft Graph and Microsoft 365 audit logs for suspicious application-driven calendar activity, particularly events in the far future, and unusual subjects and attachments. They should also look for indicators such as the `cloudlanecdn[.]com` domain and the `logAzure.txt` file, enforce Conditional Access, restrict and audit OAuth client-credential applications, and monitor outbound DNS for tunneling patterns.
**Recommendations for Affected Organizations:**
* Monitor Microsoft Graph and Microsoft 365 audit logs for suspicious application-driven calendar activity
* Enforce Conditional Access to limit access to sensitive resources
* Restrict and audit OAuth client-credential applications
* Monitor outbound DNS for tunneling patterns
**Indicators of Compromise:*
* `cloudlanecdn[.]com` domain
* `logAzure.txt` file
**Threat Actor:**
The threat actor behind HollowGraph is believed to be an Iranian group targeting entities in Israel. The malware’s use of a hybrid encryption scheme and DNS tunnelling suggests significant technical capabilities and operational maturity.
**Conclusion:**
HollowGraph represents a new and sophisticated threat vector for attackers, using compromised Microsoft 365 mailboxes as a command-and-control channel. Organizations must remain vigilant and implement robust security measures to prevent such attacks.
Source: Original article