HollowGraph Malware Abuses Microsoft Graph for C2

A newly identified malware, named HollowGraph, has been observed utilizing the calendar functionality within compromised Microsoft 365 mailboxes to establish a command-and-control (C2) channel. This technique allows attackers to discreetly send commands to infected systems and exfiltrate sensitive data without relying on traditional C2 infrastructure, which is often more easily detected and blocked by security measures.

The malware exploits the legitimate Microsoft Graph API, specifically targeting the calendar events feature. Attackers can schedule meetings or create calendar entries that contain encoded commands. The HollowGraph malware, running on the victim's machine, then periodically checks these calendar events for new instructions. This method blends malicious activity with normal user behavior, making it significantly harder for security software to distinguish between legitimate and malicious network traffic.

Beyond receiving commands, HollowGraph also uses the calendar feature for data exfiltration. Stolen information can be encoded within the details of calendar events, which are then sent to attacker-controlled accounts. This approach offers a novel way for threat actors to bypass network defenses and maintain persistence within an organization's environment. The discovery of HollowGraph highlights the evolving tactics of cybercriminals in leveraging cloud-based services for malicious purposes.

Security researchers have noted that this method of abusing cloud services for C2 communications is becoming more prevalent. Organizations using Microsoft 365 are advised to implement robust monitoring of their Graph API usage and calendar activities. Enhanced endpoint detection and response (EDR) solutions capable of identifying anomalous API calls and unusual calendar event patterns are crucial for detecting and mitigating threats like HollowGraph. Further analysis is ongoing to understand the full scope of HollowGraph's capabilities and the extent of its deployment.