HollowGraph — Microsoft 365 Calendar as Covert C2

HollowGraph is a .NET NativeAOT-compiled DLL implant reported by Group-IB on 2026-07-20. Its defining trait is that it never talks to attacker infrastructure for tasking or exfil: it drives the Microsoft Graph API against a compromised Microsoft 365 mailbox calendar, treating the calendar as a two-way dead drop. Operators plant tasking as a calendar event buried at 2050-05-13 (24 years out, so the mailbox owner never scrolls to it); the implant reads it with a get command, and exfiltrates stolen files with a send command as encrypted attachments (File{n}.txt) on new far-future events. Payloads use hybrid RSA + AES-256 with separate inbound/outbound key pairs.

A second, out-of-band channel refreshes the implant's stolen OAuth credentials (tenantId / clientId / clientSecret / target mailbox) by decoding bytes smuggled inside IPv6 AAAA records answered by the attacker domain cloudlanecdn[.]com, then writing them to an on-disk config named logAzure.txt (dressed up as a routine log). Group-IB ties the implant to the Cavern framework with high confidence (matching command grammar, the 003 debug self-command) and notes only a low-confidence overlap with Lyceum (an OilRig subgroup); it does not attribute the campaign. Roughly 12 machines were seen infected, about 3 actively communicating, with victim traffic 2026-06-03 to 2026-07-09.

Highest-value defensive angle: because the C2 rides trusted Microsoft cloud services, endpoint network detection alone is weak. The strongest signals are (1) the on-disk artifact logAzure.txt, (2) DNS AAAA lookups to cloudlanecdn[.]com and its *.p/*.q tunnel labels, and (3) M365/Entra audit evidence of an application identity writing far-future calendar events with GUID / "Event ID:" subjects and File{n}.txt attachments.

Defender priority: Hunt the M365 audit trail and the credential channel, not just the box. Enumerate application registrations holding Calendars.ReadWrite / Mail.Read application permissions, hunt calendar items dated 2050 across all mailboxes, and rotate any tenant/client secrets found in logAzure.txt. The endpoint DNS + config-file hunts here are the tripwire; the M365 audit hunts are the confirmation.

Four sources fetched and saved verbatim to HollowGraph-M365Calendar-Hunt-sources/ at research time. Every atomic indicator in this pack traces to snapshot 01 (Group-IB primary) and is corroborated by the T2 press. The Register carries the narrative but not the atomic IOC appendix.

Provenance note: the SHA256 samples and the Lyceum pivot hash are carried from the Group-IB appendix (snapshot 01). No public IPs were published; the C2 is domain-only. Where a campaign artifact is a pattern rather than a literal (File{n}.txt, GUID subjects), it is shipped as a behavioral signature, not an atomic block.

Hypothesis: If HollowGraph is active, we should see a .NET DLL host process on an endpoint that (a) drops/reads logAzure.txt, (b) issues bursts of AAAA DNS lookups to cloudlanecdn[.]com subdomains, and — in the M365 tenant — an application identity creating/reading calendar events dated 2050 with GUID / "Event ID:" subjects and File{n}.txt attachments.

The calendar C2 lives in the Microsoft cloud, not on the wire, so the confirming evidence is in the M365 Unified Audit Log and Entra sign-in/audit logs. These run in Microsoft 365 / Purview / Sentinel (KQL over ingested logs), not Falcon CQL. Field names and RecordType values are tenant/parser specific — validate against a sample row before deploying.

S7-A · M365 Unified Audit Log — far-future calendar events by an app identity

// Microsoft 365 Unified Audit Log (Purview) / Sentinel — Graph-driven calendar dead drop
// Anomalous Exchange calendar item create/update by a client-credentials application,
// with far-future (2050) dates or HollowGraph subject/attachment patterns.
OfficeActivity
| where Operation in ("Create", "Update", "Send")
| where RecordType startswith "Exchange"          // calendar items are Exchange records
| where isnotempty(ClientAppId)                    // application-driven (non-interactive) write
| where Item has "2050"                            // planted 2050-05-13 tasking / exfil events
    or Subject matches regex @"^Event ID:|^Boss.*ID|^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-"
    or Item has "File" and Item has ".txt"         // File{n}.txt attachment naming
| project TimeGenerated, UserId, ClientAppId, ClientIP, Operation, Subject, Item
| sort by TimeGenerated desc

S7-B · Entra ID — client-credential app grant + non-interactive Graph token use

// (a) An app registration granted broad calendar/mail APPLICATION permissions or a fresh secret
AuditLogs
| where OperationName in ("Add app role assignment to service principal",
                          "Add delegated permission grant",
                          "Consent to application",
                          "Add service principal credentials")
| where Result == "success"
| project TimeGenerated, OperationName, InitiatedBy, TargetResources

// (b) Service-principal (client-credentials) Graph sign-ins spiking from one IP/ASN
AADServicePrincipalSignInLogs
| where isnotempty(AppId)
| where ResourceDisplayName == "Microsoft Graph"
| summarize calls = count() by AppId, IPAddress, bin(TimeGenerated, 1h)
| where calls >= 50                               // tune per tenant baseline

Pair these with the endpoint hunts in section 8: a host firing Q1/Q3 plus an app identity firing S7-A on the same day is a high-confidence HollowGraph confirmation.

IOA-1 · DLL host resolving the C2 domain

Rule group: Covert C2 · Type: Network Connection / DNS Request · Action: Detect (promote to Block only after FP baseline) · Severity: High · MITRE: T1071.004.

• Domain (PCRE): (^|\.)cloudlanecdn\.com$
• Exclusions: none needed — atomic C2 domain.
• Rationale: real-time detect of any host touching the DNS channel; complements Q3/Q4 retro hunts.

IOA-2 · rundll32/regsvr32 loading a DLL from a user-writable path

Rule group: LOLBIN Abuse · Type: Process Creation · Action: Detect · Severity: Medium · MITRE: T1218.010/.011.

• Image Filename (PCRE): .*\\(rundll32|regsvr32)\.exe$
• Command Line (PCRE): .*\\(Users|ProgramData|AppData|Temp|Public)\\.*\.dll.*
• FP tuning: heavy legitimate use — keep in Detect; pilot on a canary group before any Block promotion.

Do not promote either IOA to Block until it has run in Detect for 14+ days with a measured FP rate under 5%. IOA-2 in particular has a high legitimate-use baseline.

Quick-copy blocks for import and hunting. Atomic indicators (domain + hashes) trace to the saved Group-IB snapshot; pattern indicators ship as behavioral signatures, not blocks.

type,value,action,severity,expiration,description,tags
domain,cloudlanecdn[.]com,detect,high,2027-01-21,HollowGraph DNS C2 and credential-refresh tunnel,campaign:HollowGraph
sha256,75e51774b8f79e5f256eaae639635f911b3e744d4774fd6068dd980255621509,prevent,critical,2027-07-21,HollowGraph .NET NativeAOT DLL implant,campaign:HollowGraph
sha256,f3f3006f8304788251b153d53b305322b8acab0c66ec816b8d9f101bcc851da3,prevent,critical,2027-07-21,HollowGraph .NET NativeAOT DLL implant,campaign:HollowGraph
sha256,b3d0f6e4e3be395fd7cf9e8101c89963d77216578cbb117a6ac9bc3564485eff,prevent,critical,2027-07-21,HollowGraph .NET NativeAOT DLL implant,campaign:HollowGraph
# attribution pivot only (do NOT block) - related Lyceum 2025 .NET backdoor:
# 315bdba98c6fe863d39f6afccc727e17d5aea63bf21259444fa988cae56d61c1

logAzure.txt            on-disk config storing tenantId/clientId/clientSecret + RSA keys
File{n}.txt             encrypted calendar-event attachment naming (File0.txt, File1.txt, ...)
2050-05-13              far-future calendar event date for planted tasking / exfil events
Subject Event ID: {7-char taskID}   GET / tasking event subject pattern
Subject Boss{..}ID{..}              SEND / exfil event subject pattern
Subject bare GUID                   operator-recognition rename pattern
*.p.cloudlanecdn[.]com  DNS-tunnel length-query labels (AAAA)
*.q.cloudlanecdn[.]com  DNS-tunnel data-query labels (AAAA, 14 bytes/record)
command grammar: get / send / 003(debug)   Cavern-style tasking verbs

HollowGraph       .NET NativeAOT DLL implant (this campaign)
Cavern            modular espionage framework - HIGH-confidence code overlap
Cavern Manticore  Iranian MOIS-linked cluster associated with Cavern (per THN)
Lyceum / OilRig   Iranian-nexus subgroup - LOW-confidence overlap only, NOT attributed

- Enumerate app registrations with Calendars.ReadWrite / Mail.Read / Mail.ReadWrite APPLICATION permissions
- Review client-secret creation (Add service principal credentials) in the last 90 days
- Hunt calendar items dated 2050 across all mailboxes (Graph: /users/{id}/calendarView)
- Revoke + rotate any tenantId/clientId/clientSecret found in logAzure.txt on affected hosts
- Conditional Access: block non-interactive client-credential flows from unmanaged IPs
- Alert on app-only Graph calendar writes (Calendars.ReadWrite used by a daemon app)

Validate with benign payloads on isolated/canary endpoints only — never real malware, never production.

P1 · Enumerate risky Graph application permissions (Microsoft Graph PowerShell)

Connect-MgGraph -Scopes "Application.Read.All","AuditLog.Read.All"
$risky = "Calendars.ReadWrite","Mail.Read","Mail.ReadWrite"
Get-MgServicePrincipal -All | ForEach-Object {
  $sp = $_
  Get-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $sp.Id |
    Where-Object { $risky -contains $_.AppRoleId } |
    Select-Object @{n='App';e={$sp.DisplayName}}, AppRoleId, ResourceDisplayName
}

P2 · Hunt 2050-dated calendar events across mailboxes (Graph)

# For each in-scope mailbox, pull events in the 2050 window and flag suspicious subjects
# GET /users/{id}/calendarView?startDateTime=2050-01-01T00:00:00Z&endDateTime=2050-12-31T23:59:59Z
# Review Subject for: GUID-only, "Event ID:", "Boss..ID..", and any File{n}.txt attachment

P3 · Sinkhole / block the DNS channel

# Resolver RPZ / proxy block
# cloudlanecdn.com  CNAME  sinkhole.internal.   ; block + log all *.cloudlanecdn.com
# Alert on any client that attempted resolution prior to the block taking effect

Deploying via your RMM: the snippets above are raw PowerShell / config. Hand them to your RMM deployment tooling for admin checks, error handling, and custom-field writeback for compliance tracking.

Coverage: 6 of 7 behaviors have at least partial detection. The residual GAP is direct observation of managed RSA/AES assembly loading — Falcon has limited managed-assembly-load telemetry, so it is hunted indirectly via the DLL-host process (Q7). Validation gates (section 11) must pass before these are relied on operationally.