Microsoft 365 calendars have become a hiding place for espionage malware, with commands and stolen files stashed inside appointments dated to the year 2050, researchers from Group-IB discovered.
Targeted campaign tied to Iranian espionage activity
The malware, which Group-IB calls HOLLOWGRAPH, is one component of a bigger toolkit the company links with high confidence to the Cavern backdoor framework, a modular espionage toolkit built from separate plugins that each handle a different task, previously tied to Iran-linked activity.
Group-IB identified 12 infected systems (three actively communicating), all evidence pointing to a narrowly targeted espionage operation against Israeli entities.
The earliest recorded contact between a victim and the attacker dates to June 3, 2026, and the most recent to July 9, 2026, a window showing the malware has been in active use since at least early June.
“Based on the evidence currently available, we cannot confidently attribute this activity to any previously identified threat actor. However, our analysis identified several technical similarities with the Iranian-nexus threat actor Lyceum,” researchers said.
“While these overlaps are noteworthy, they are not sufficiently unique to support a high-confidence attribution. At this stage, we assess a potential link to Lyceum with low confidence.”
HOLLOWGRAPH uses Graph API, calendar events, and DNS tunneling
HOLLOWGRAPH only takes two commands: get and send. It reaches these through the Microsoft Graph API, using a compromised Microsoft 365 mailbox.
HOLLOWGRAPH command-and-control communication (Source: Group-IB)
To hand over instructions, the attacker creates a calendar event. The malware checks for these events and pulls out the attached data. To send stolen files back, the malware creates its own calendar event and attaches the encrypted files there.
“To avoid catching the mailbox owner’s attention, every event is dated far into the future — 13 May 2050 — with payloads attached as files to the event,” they added.
A separate channel handles credential renewal. The malware uses DNS tunneling, sending IPv6 lookups to an attacker-controlled domain, to refresh the Microsoft Entra ID (Azure AD) credentials it needs for the Graph API, then saves the updated values to a file on disk disguised as a log.
All the calendar traffic is encrypted too, with separate keys for incoming instructions and outgoing files, so cracking one direction wouldn’t expose the other.
Detection guidance for security teams
Security teams can watch for a few signs tied to this activity: calendar events dated May 13, 2050, and subject lines matching patterns like Event ID: or Boss{..}ID{..} with File{n}.txt attachments. Mailbox audit logs that show calendar changes made by an application are worth checking too.
Group-IB also recommends restricting and auditing OAuth2 apps that use client credentials, and setting up alerts when new client secrets get created. Conditional Access, credential rotation, and catching unusual tokens are the other basics the company points to for Microsoft 365 and Entra ID.
Details on indicators of compromise are available in the blog.
