HOLLOWGRAPH Backdoor Turns Microsoft 365 Calendars Into a C2 Channel

Key Takeaways

• HOLLOWGRAPH is a Windows espionage backdoor delivered as a .NET NativeAOT DLL masquerading as a Brotli library.
• It uses compromised Microsoft 365 calendar events as a two-way dead drop for tasking and exfiltration.
• Hybrid RSA-OAEP and AES-256-GCM encryption protects Graph payloads, with separate RSA key pairs for each direction.
• DNS tunneling over IPv6 AAAA records refreshes Entra ID credentials and preserves mailbox access after secret rotation.
• Picus Platform lets teams simulate HOLLOWGRAPH attacks and validate security controls against the malware.

HOLLOWGRAPH is a Windows espionage backdoor, delivered as a .NET NativeAOT-compiled DLL, that was first observed in early June 2026 [1].

Its defining trait is that it never talks to an attacker-owned server for command or payload traffic. Instead, it abuses the Microsoft Graph API against a compromised Microsoft 365 mailbox and treats that mailbox's calendar as a two-way dead drop.

Operator tasking arrives as calendar events, stolen files leave as encrypted event attachments, and every event is stamped with a far-future date so it stays out of the mailbox owner's view.

In this analysis, we break down what HOLLOWGRAPH is and walk through how it operates at each stage of its execution flow. In the end, we will show how Picus Platform helps you validate your security controls against this threat.

HOLLOWGRAPH at a Glance

What Is HOLLOWGRAPH Malware?

HOLLOWGRAPH is a Windows backdoor and data-exfiltration implant. Technically, it is a .NET assembly compiled with NativeAOT and shipped as a DLL, and it is loaded on the victim by a separate framework component that acts as the orchestrator.

On disk, the DLL masquerades as a Brotli compression library so it blends in with legitimate dependencies.

The implant is deliberately minimal. It exposes only two commands, get and send, and routes both through Microsoft's own cloud rather than through dedicated attacker infrastructure. This design lets its malicious activity ride inside ordinary enterprise Microsoft 365 traffic.

At its core, HOLLOWGRAPH does three things [1]:

1. Receives tasking through a dead drop. The get command reads operator commands hidden inside calendar events on a compromised Microsoft 365 mailbox.
2. Exfiltrates files through the same dead drop. The send command encrypts a target file and uploads it as one or more attachments on a newly created calendar event.
3. Keeps its cloud access alive. A DNS tunneling channel over the attacker domain cloudlanecdn[.]com pulls down fresh Microsoft Entra ID (Azure AD) credentials and rewrites them into a local configuration file, so that expired or defender-rotated secrets do not sever its access to the mailbox.

How Does HOLLOWGRAPH Malware Work?

HOLLOWGRAPH operates through three core mechanisms: a Graph API dead drop, hybrid encryption, and DNS-based credential refresh.

We will detail these mechanisms in the sections below.

Local Configuration

The binary carries a hardcoded configuration blob. On execution, it writes that configuration to disk as logAzure.txt, a filename chosen to pass as a normal log artifact. The DNS tunneling channel later overwrites individual fields in this same file as credentials rotate.

The configuration holds everything the implant needs to reach its Graph dead drop:

• Entra ID Tenant ID: Azure AD tenant of the compromised mailbox.
• Entra ID Client (Application) ID: OAuth2 application identity used for authentication.
• Entra ID Client Secret: Secret paired with the client ID for client-credentials auth.
• Target mailbox: Compromised Microsoft 365 mailbox used as the dead drop.
• C2 DNS domain: cloudlanecdn[.]com, used for the DNS credential-refresh channel.
• RSA public key (2048-bit): wraps the per-file AES-256 key used to encrypt exfiltrated data before upload (outbound direction).
• RSA private key (2048-bit): unwraps the AES-256 key needed to decrypt operator tasking pulled from the calendar (inbound direction).

Hybrid Cryptography With Directional Key Separation

HOLLOWGRAPH protects all Graph payloads with a hybrid scheme.

RSA-OAEP (SHA-256) wraps a freshly generated AES-256 key, and the payload itself is sealed with AES-256-GCM.

The important design choice is that inbound and outbound traffic use independent RSA key pairs. Tasking that the implant decrypts uses one key pair, and files it exfiltrates use another, so the two directions stay cryptographically separate.

Microsoft Graph API C2: The Calendar Dead Drop

Both HOLLOWGRAPH commands (get and send) operate on the compromised mailbox's calendar over Microsoft Graph.

Every event the malware touches is fixed to a single far-future window, 2050-05-13 from 22:00 to 23:00 UTC, so the tasking and exfil events sit decades away from anything the mailbox owner would notice.

get: Retrieving Operator Tasking

The get command locates the operator's event in the fixed date window, filters by subject, pulls the attachment, and decrypts it with the RSA private key from the configuration [1]:

send: Exfiltrating Files

The send command encrypts a target file with the configured RSA public key and uploads it back to the same calendar.

The event is created first with a throwaway subject, then populated with attachments, then renamed so the operator can spot it [1]:

Each encrypted chunk is base64-encoded and attached as an application/octet-stream file.

Structured Command Invocation

A task retrieved from the calendar dead drop and decrypted is a small JSON object. One recovered example looks like this [1]:

DNS Tunneling for Credential Refresh

To keep authenticating to Graph as secrets rotate, the implant pulls fresh values for four Entra ID fields (tenant ID, client ID, client secret, and mailbox) over DNS, then writes them back into logAzure.txt.

All lookups are AAAA (IPv6) queries resolved through the DnsClient.NET library, against specially encoded subdomains of cloudlanecdn[.]com [1].

To see how reassembly works, consider the implant refreshing the client secret (field index 2) under task ID aB3xK9z, where the returned value is the 30-byte string Hq7ZKp2RtLn6xVc0bYs5aQm8Wd4FgH.

First, the implant issues a LENGTH query and reads the total size from the first 2 bytes of the AAAA answer:

It then walks the payload in 14-byte steps, one DATA query per chunk, advancing the offset by 14 each time. Each AAAA answer carries 14 usable payload bytes packed into its 16-byte address:

Concatenating the three chunks yields Hq7ZKp2RtLn6xVc0bYs5aQm8Wd4FgH, which the implant decodes as UTF-8 text, stores into the client-secret field, and persists back to logAzure.txt.

The same sequence repeats for field indexes 0, 1, and 3 (tenant ID, client ID, and mailbox), leaving the implant with a full, refreshed credential set.

How Picus Simulates HOLLOWGRAPH Malware Attacks?

We strongly suggest simulating HOLLOWGRAPH Malware Attacks to test the effectiveness of your security controls against real-life cyber attacks using the Picus Platform. You can also test your defenses against hundreds of other malware variants, such as BRICKSTORM, VenomRAT, Chinotto, and Rustonotto, within minutes with a 14-day free trial of the Picus Platform.

Picus Threat Library includes the following threats for the HOLLOWGRAPH Malware Attacks:

Start simulating emerging threats today and get actionable mitigation insights with a 14-day free trial of the Picus Platform.

References

[1] J. Castillo, “HOLLOWGRAPH: Turning Microsoft 365 Calendars into Covert Command-and-Control Channels,” Group-IB. Accessed: Jul. 24, 2026. [Online]. Available: https://www.group-ib.com/blog/hollowgraph-microsoft-365/