Espionage Malware Hijacks Microsoft 365 Calendar Events to Exfiltrate Data from Israeli Targets
What Happened — Researchers at Group‑IB uncovered a new espionage tool, HOLLOWGRAPH, that uses Microsoft 365 calendar entries as a covert command‑and‑control (C2) channel. The malware creates future‑dated events (e.g., May 13 2050) to receive commands and to upload encrypted stolen files, while refreshing Azure AD credentials via DNS tunneling. Twelve compromised systems (three actively communicating) were identified, all linked to a narrowly‑targeted campaign against Israeli entities.
Why It Matters for Compliance & Audit Readiness
- The technique exploits legitimate Microsoft 365 Graph API access, highlighting gaps in access‑control monitoring and privileged‑account management required by SOC 2 CC6.1 (Logical Access).
- Encrypted calendar traffic evades traditional network‑based detection, underscoring the need for continuous audit evidence of mailbox activity logs and application‑level permissions.
- The incident demonstrates how credential renewal mechanisms can be weaponized, reinforcing the importance of documented credential‑rotation policies and real‑time verification.
Who Is Affected – Primarily organizations using Microsoft 365 for email and calendar services, especially those in the technology, professional services, and government sectors in the Middle East.
Recommended Actions
- Map the incident to SOC 2 CC6.1 controls; verify that privileged‑access reviews include Graph‑API permissions and mailbox audit logs.
- Deploy continuous monitoring of calendar‑event creation/modification via Microsoft 365 audit logs; retain evidence for audit trails.
- Enforce MFA and periodic credential rotation for service accounts accessing Azure AD and Graph API.
- Conduct a targeted threat‑hunt for calendar events dated far in the future and anomalous DNS‑tunneling traffic.
Technical Notes – HOLLOWGRAPH communicates through the Microsoft Graph API using a compromised mailbox; commands are “get” and “send.” Exfiltration is performed by attaching encrypted files to future‑dated calendar events. Credential renewal leverages IPv6 DNS queries to an attacker‑controlled domain, storing refreshed tokens as disguised log files. Source: Help Net Security