HollowGraph Malware Leverages Microsoft Graph Calendar for Stealthy C2 and Data Exfiltration

HollowGraph Malware Leverages Microsoft Graph Calendar for Stealthy C2 and Data Exfiltration

What Happened – Researchers identified a new malware module, HollowGraph, that abuses the Microsoft 365 calendar feature via the Microsoft Graph API to receive commands and exfiltrate encrypted data. The sample uses hard‑coded tenant, client, and secret values from compromised Office 365 accounts and hides payloads in calendar events dated “May 13 2050.” At least 12 systems have been infected, with three actively communicating between June 3 and July 9 2026.

Why It Matters for Compliance & Audit Readiness

• Demonstrates how legitimate cloud APIs can become covert command‑and‑control channels, a scenario SOC 2 access‑control criteria (CC6.1, CC6.2) are designed to detect and log.
• Highlights the need for continuous monitoring of privileged Microsoft Graph activity and evidence collection to satisfy audit‑ready logs and incident‑response documentation.
• Reinforces the importance of strong credential‑management controls (MFA, least‑privilege, secret rotation) to prevent unauthorized API use, directly mapping to SOC 2 security principle “Logical Access Controls.”

Who Is Affected – Organizations that rely on Microsoft 365 / Azure AD (technology‑SaaS, cloud‑infra, and any sector using Office 365 for email and calendar).

Recommended Actions

• Enforce MFA and conditional access for all accounts with Graph API permissions.
• Implement least‑privilege application registrations; regularly review and revoke unused client secrets.
• Deploy continuous monitoring of Graph API calls (audit logs, anomalous calendar activity, impossible‑time events).
• Encrypt and protect configuration files; rotate secrets on a defined schedule.
• Update incident‑response playbooks to include “cloud‑API abuse” scenarios and retain forensic logs for SOC 2 evidence.

Source: BleepingComputer

Technical Notes –

• Attack vector: Stolen credentials used to authenticate to Microsoft Graph; secondary DNS‑tunnelling channel for secret updates.
• Data types: Encrypted files exfiltrated via calendar attachments; RSA/AES‑256‑GCM encryption.
• Indicators: logAzure.txt config file, calendar events titled “Boss{…}ID{…}”, IPv6 AAAA queries to cloudlanecdn.com.