Malware Turns Microsoft 365 Calendars into Covert Attack Channels

Malware has been discovered that exploits Microsoft 365 calendars to carry out covert attacks on targeted organizations. Researchers at Group-IB found a Windows malware strain, dubbed HOLLOWGRAPH, which uses compromised Microsoft 365 accounts and the Microsoft Graph API to conceal command-and-control activity within legitimate cloud communications.

The malware turns the compromised account's calendar into a 'two-way dead drop,' allowing attackers to create encrypted events with instructions for the malware. The stolen files are then uploaded as attachments to separate events, scheduled for May 13, 2050, far outside the mailbox owner's normal calendar view.

HOLLOWGRAPH operates with only two commands: 'get' for retrieving instructions and 'send' for exfiltrating files. Group-IB linked the malware to the Cavern backdoor framework based on similarities in command syntax and architecture.