How a piece of espionage malware turned Microsoft 365 calendars into a secret communications system—and why the most trusted parts of the internet are becoming the hardest places to defend.

Somewhere inside a Microsoft 365 account, on a calendar belonging to a real organization, there was an appointment scheduled for May 13, 2050.

It was not a planning meeting, a retirement reminder, or an unusually ambitious attempt to reserve a conference room. No one was expected to attend. The date was chosen precisely because no ordinary user was likely to look at it. Attached to the appointment were small text files containing encrypted information. Other events in the same narrow, far-future window carried instructions intended not for an employee but for a piece of malware.

The calendar had become a dead drop.

For most of the history of espionage, a dead drop was a physical place: a loose brick, a hollow tree, a package taped beneath a park bench. One person left something behind; another retrieved it later. The participants did not need to meet, and anyone watching only one of them might never see the exchange.

HollowGraph, a newly documented Windows implant, applies the same logic to the cloud. Rather than constantly calling an obviously suspicious server controlled by its operators, the malware communicates through a compromised Microsoft 365 mailbox. It looks for commands in calendar appointments and returns stolen files by attaching them to appointments of its own. The traffic travels through Microsoft’s legitimate cloud infrastructure using Microsoft Graph, the ordinary programming interface through which authorized applications interact with calendars, mailboxes, files, users, and other Microsoft 365 services.

On a corporate network, communication with Microsoft 365 is not unusual. It is ambient. Employees open Outlook, join Teams meetings, synchronize documents, check schedules, and use applications that communicate with Microsoft’s cloud throughout the working day. Blocking that traffic would be a little like securing an office by turning off the electricity. HollowGraph’s designers understood that a trusted service can provide something more valuable than secrecy: normality.

That is what makes the discovery interesting beyond the relatively small number of systems so far identified. HollowGraph is not merely another new specimen of malware. It is a compact demonstration of how modern espionage increasingly operates inside the digital infrastructure organizations depend upon most heavily—and how the old distinction between “our network” and “the internet” has become badly misleading.

The security company Group-IB reported finding HollowGraph on at least twelve systems. Only about three were actively communicating with the operators during the company’s observation period, which ran from June 3 through July 9, 2026. The compromised mailbox and other evidence pointed toward Israeli entities, although the available evidence does not establish that every infected system belonged to an Israeli victim. The small scale and selective communication suggest a targeted espionage operation rather than a mass campaign. Group-IB’s HollowGraph research provides the principal technical account.

This is an important distinction. Twelve infections do not constitute a global emergency. There is no evidence that ordinary Microsoft 365 users are being indiscriminately attacked, nor did the researchers report a flaw in Microsoft 365 that allows anyone to commandeer a calendar. HollowGraph depends on access to a compromised account and valid Microsoft cloud credentials. Microsoft’s service is being misused, not described as having been broken.

Yet small espionage operations often deserve more attention than large, noisy criminal campaigns. Ransomware advertises its presence by stopping work and presenting a demand. Espionage succeeds by remaining beneath the threshold of concern. Its value may reside in a handful of carefully chosen organizations: a government office, a technology supplier, a research institution, a diplomatic contractor, or a company whose network provides a path into more sensitive targets.

HollowGraph’s apparent simplicity is part of its elegance. The component analyzed by Group-IB supports only two basic instructions: “get” and “send.” With “get,” it searches the compromised calendar for an event bearing a particular identifier, downloads the attached files, decrypts them, and passes the recovered instructions to the larger malware system. With “send,” it encrypts a selected file from the victim’s computer, creates a calendar appointment, and uploads the stolen material as one or more attachments.

The appointments are scheduled in a fixed one-hour period on May 13, 2050. Some begin with randomly generated subjects before being renamed according to patterns the operators recognize. The attachments receive innocuous names such as File1.txt or File2.txt. To the mailbox owner, assuming the owner ever searched twenty-four years into the future, the events might look like malformed software debris rather than the correspondence of an intelligence operation.

The malware encrypts the contents before uploading them. This means that even someone who discovers the files cannot simply open them and read the instructions or stolen data. HollowGraph uses one set of cryptographic keys for commands flowing toward the infected machine and a different set for information flowing out. The technical implementation combines two familiar forms of encryption: one well suited to protecting the data itself and another used to protect the temporary key. The details matter to malware analysts, but the basic purpose is readily understood. Discovering the envelope does not reveal the letter.

Microsoft Graph is what makes the exchange possible. Despite its name, Graph is not a chart or a single application. It is a common doorway through which software can request access to Microsoft cloud resources. A scheduling application might use it to create calendar events. A business dashboard might use it to retrieve documents. A human-resources system might use it to look up employee information. Used properly, Graph lets organizations connect services without asking users to perform every action manually.

To use that doorway, an application must present credentials and receive authorization. Those permissions may be associated with a person, or they may belong to an application acting independently. In HollowGraph’s case, the recovered configuration contained a Microsoft Entra tenant identifier, an application identifier, a client secret, the target mailbox address, and the cryptographic keys needed for the exchange. Entra ID is Microsoft’s cloud identity system, formerly known as Azure Active Directory. A client secret functions somewhat like an application password.

This is where the incident becomes more than a clever calendar story. Organizations have spent years learning to protect human accounts with stronger passwords, multifactor authentication, suspicious-login alerts, and other controls. Software identities are often governed less carefully. They do not complain when given broad permissions. They do not notice an unfamiliar login screen. Their credentials may sit in configuration files, deployment systems, scripts, or development repositories for months or years.

A valid application identity can therefore become a durable passport. If an attacker obtains its secret and the application has permission to reach a mailbox, the resulting activity may not resemble a person breaking into an account. It may resemble an approved program doing exactly what approved programs do.

HollowGraph’s designers also prepared for the possibility that those Microsoft credentials would expire or be revoked. The malware maintains a second communications method using the Domain Name System, or DNS—the mechanism computers ordinarily use to translate names such as a company website into network addresses.

A normal DNS query asks a modest question: Where can I find this domain? DNS tunneling turns those questions and answers into a primitive signaling system. Information is encoded into unusual domain names or returned through specially constructed responses. To a security specialist, it is the digital equivalent of communicating by arranging the addresses on a series of envelopes. The postal service is still being used for its intended purpose, but the addresses themselves carry a second meaning.

HollowGraph queries specially encoded subdomains beneath an attacker-controlled domain and requests IPv6 address records, known as AAAA records. The answers deliver updated Microsoft Entra credentials and configuration information in small fragments. The implant reassembles those fragments and writes the refreshed values to a local file named logAzure.txt, a name selected to resemble an unremarkable cloud-service log.

The DNS channel is not the malware’s main route for stolen documents or operational instructions. Its narrower job is to keep the Microsoft 365 channel alive. That division of labor is intelligent. The calendar provides a trusted place for substantive communications. DNS provides an alternative way to replace the credentials needed to enter it.

It also gives defenders two different kinds of evidence. A company may see nothing obviously malicious in a connection to Microsoft Graph, yet notice a workstation generating repeated IPv6 DNS queries involving long, irregular subdomains. Conversely, a company that retains detailed cloud records may find calendar events in the year 2050 or application access to a mailbox that the application has no sensible reason to use.

Neither clue is guaranteed to be visible. Many organizations collect enormous volumes of security information but retain the wrong details, retain them for too little time, or never examine them together. Network tools may record that a computer communicated with Microsoft without recording what the application did after connecting. Microsoft 365 auditing may contain the relevant cloud activity, while endpoint software contains the suspicious process history, and DNS logs contain the external signaling. Each system holds one page of the story.

This fragmentation has become one of the defining problems of contemporary defense. A suspicious internet domain is comparatively easy to understand. A malicious action conducted through a legitimate cloud platform requires context. Was the Microsoft Graph request made by an approved application? Does that application normally access calendars? Why did it create events decades in the future? Was the same computer making peculiar DNS requests? Did an application credential change shortly beforehand?

Security products are good at comparing objects against lists: bad file, bad address, bad domain. They have a harder time identifying legitimate objects behaving illegitimately. Microsoft Graph cannot be classified as malicious. Neither can Outlook calendars, DNS, encryption, or text attachments. The danger exists in the relationship among them.

This is why “trusted” has become such a dangerous word in cybersecurity. Trust is often treated as a permanent property. Microsoft is trusted. The corporate mailbox is trusted. The application has valid credentials. The traffic is encrypted. Therefore, the activity is allowed.

But trust is not evidence of innocence. It is a decision to reduce scrutiny. The more indispensable a platform becomes, the more likely defenders are to permit its traffic broadly—and the more valuable it becomes to an attacker seeking concealment.

HollowGraph belongs to a growing family of techniques sometimes described as “living off trusted services.” Attackers have used cloud-storage platforms to retrieve tools, public code repositories to hold instructions, messaging services to issue commands, and web services to conceal the true destination of traffic. The individual tricks change, but the strategic idea remains consistent: why build suspicious infrastructure when the world’s largest technology companies already operate fast, resilient, encrypted global networks?

Criminal infrastructure can be blocked, seized, abandoned, or exposed through registration records. A Microsoft endpoint cannot simply be placed on a blacklist without consequences. Connections are protected by encryption, which is essential for legitimate privacy but also limits what intermediate security devices can inspect. Cloud addresses may serve countless customers, making the address itself a poor indication of intent.

Attackers gain another advantage when they compromise a genuine account within the victim’s own cloud environment. They are no longer merely hiding behind a famous company’s domain. They are using resources that belong to the target. The activity may satisfy several superficial tests of legitimacy at once: recognized provider, valid credentials, authorized tenant, encrypted connection.

HollowGraph’s apparent relationship to the Cavern malware framework adds a geopolitical dimension, though it is important not to turn analytical possibility into fact. Group-IB says the technical link between HollowGraph and Cavern is strong. The command structure, formatting, and behavior align closely enough for the company to assess with high confidence that HollowGraph is part of a variant of that framework.

Attributing the operators is less certain. Check Point Research has described Cavern Manticore as an Iran-associated espionage actor targeting Israeli government and information-technology organizations, with technical relationships to threat groups linked to Iran’s Ministry of Intelligence and Security. Its researchers observed Cavern as a modular toolkit capable of file and database browsing, network reconnaissance, directory-service queries, and tunneling. In several incidents, the operators gained their foothold by abusing legitimate remote-management software already present in the victim environment. Check Point’s Cavern Manticore analysis documents those broader findings.

Group-IB, however, does not claim that HollowGraph has been definitively assigned to Cavern Manticore, Lyceum, OilRig, or the Iranian government. It reports similarities with malware previously associated with Lyceum, an Iran-linked espionage group sometimes treated as part of the broader OilRig ecosystem, but rates that connection at low confidence.

This caution is not academic throat-clearing. Malware families can be shared, purchased, copied, inherited, or deliberately imitated. Different groups may use related tools. Researchers may apply different names to overlapping clusters of activity, and governments may conceal their involvement behind contractors or intermediaries. A technical resemblance can support attribution, but it seldom proves who directed an operation.

The available evidence therefore supports a layered conclusion. HollowGraph is strongly connected to the Cavern framework. The Cavern framework has been associated by other researchers with an Iran-nexus actor. HollowGraph appears focused on Israeli targets. Together, these facts make an Iranian connection plausible. They do not make it certain.

The discipline required to preserve those distinctions is especially important during periods of political or military tension. An attribution label can escape the technical report and become a geopolitical assertion. Once repeated in headlines, “possibly associated with” often mutates into “conducted by.” The public is left with certainty the original analysts never expressed.

What can an ordinary organization learn from a narrowly targeted espionage tool? The first lesson is not that everyone should search every calendar for events in 2050—although organizations with serious exposure to state-linked threats should certainly hunt for HollowGraph’s known patterns. The larger lesson is that cloud activity must be treated as part of the security perimeter.

For years, the conventional mental picture of cybersecurity placed the company network inside a wall and the dangerous internet outside it. Employees and servers lived within the protected zone. Firewalls inspected the gates. That picture was always imperfect, but cloud computing, remote work, mobile devices, outsourced platforms, and software-to-software integrations have made it nearly obsolete.

A company’s operational identity now extends into Microsoft 365, Google Workspace, cloud-hosting accounts, customer-management systems, code repositories, support platforms, and dozens or hundreds of specialized services. The keys to those systems may be held not only by employees but by applications. A compromised cloud identity can be as consequential as a compromised laptop—and sometimes more difficult to notice.

The second lesson is that multifactor authentication, valuable as it is, does not solve every identity problem. It is designed primarily to make stolen human passwords less useful. Application secrets, access tokens, certificates, and previously authorized integrations may follow different rules. An attacker who steals the right software credential may never encounter a prompt on anyone’s phone.

Organizations should therefore know which applications can access Microsoft 365, which mailboxes and files they can reach, who created them, and whether their permissions remain necessary. New client secrets and changes to application credentials deserve scrutiny. So do application logins from unusual locations or at unusual times. Microsoft’s own incident-response guidance recommends examining service-principal sign-ins for unexpected addresses, failures, timing, frequency, and target resources. Microsoft’s compromised-application investigation guidance explains the relevant checks.

This does not mean that every small organization needs a room full of threat hunters studying cloud telemetry around the clock. It means that administrators should avoid granting applications broad access merely because doing so makes installation easier. Credentials should be rotated, unused integrations removed, and permissions kept as narrow as practical. Logs should be retained long enough to investigate an incident discovered weeks or months after it began.

The third lesson concerns DNS. Many organizations permit computers to send DNS requests directly to outside services, or they retain little information about those requests. Requiring devices to use controlled company resolvers creates a useful observation point. Strange bursts of requests, unusually long subdomains, and unexpected volumes of IPv6 address lookups can reveal tunneling that would otherwise blend into basic network activity.

No single unusual query proves compromise. Modern software generates a great deal of odd-looking traffic. The goal is not to treat every anomaly as an emergency but to connect weak signals. A peculiar DNS pattern from an employee workstation becomes more important if the same system contains an unfamiliar DLL, a suspicious configuration file, or unexplained access to a cloud mailbox.

The fourth lesson may be the least comfortable: organizations cannot buy their way out of contextual judgment. Automated security systems remain indispensable because no human team can inspect every file, login, query, and cloud request. But an operation like HollowGraph is deliberately composed of individually permissible actions. The malware does not need every action to be invisible. It needs each one to appear too ordinary to justify interruption.

Data science can help by establishing what normal behavior looks like and identifying combinations that depart from it. But “normal” is a moving target. Software updates, employee travel, new integrations, and changes in work habits constantly alter the baseline. A model can identify an event in 2050 as unusual. A person still has to determine whether it is a harmless application artifact, an eccentric executive’s reminder, or an espionage mailbox.

There is also a temptation to admire malware like HollowGraph too much. Its designers were resourceful, but the romantic image of the ingenious hacker can obscure the mundane prerequisites. The operators still needed an initial foothold. They still needed a compromised Microsoft 365 account or application identity. They still left files, configuration data, DNS traffic, calendar objects, and recognizable command patterns behind. Group-IB found them because even careful operations create evidence.

The discovery is therefore neither proof that cloud services are indefensible nor an argument for retreating from them. Microsoft 365 did not make espionage possible. It provided a useful hiding place after other security boundaries had failed. Properly configured cloud logging may also provide some of the best evidence for reconstructing what happened.

That dual character is central to modern computing. The same programming interface that helps a company automate its calendar can help malware operate a dead drop. The same encryption that protects employees from interception protects stolen files from investigators. The same DNS infrastructure that makes the internet usable can carry secret instructions. Technologies do not arrive with fixed moral alignments. Their security depends on credentials, permissions, visibility, and use.

HollowGraph’s appointment on May 13, 2050, is memorable because it feels faintly absurd. Espionage is supposed to involve shadowed rooms and coded broadcasts, not calendar invitations sitting patiently beyond the expected life span of the computers that created them.

Yet the far-future date was not merely a clever flourish. It exploited a habit. People look at yesterday, today, next week, and perhaps next year. Software can look anywhere. The attackers found a region of a familiar system that was technically available but psychologically unoccupied.

That may be the most useful way to understand the operation. HollowGraph hid not in some exotic corner of the internet, but in a blind spot created by familiarity. The calendar was trusted because it was ordinary. Microsoft traffic was permitted because it was necessary. The application credentials worked because machines cannot become suspicious of their own accord.

The meeting never existed. The communication did. And for a time, the calendar performed exactly as its secret users intended.

If you would like to support our work — useful, well-researched, ad-free cybersecurity intelligence — subscribe, comment, or buy us a coffee! Thanks.