A newly discovered espionage implant has been using a hijacked Microsoft 365 calendar as its command channel, planting operator instructions and smuggling out stolen files as attachments on calendar events dated to the year 2050.
Group-IB, which named the malware HollowGraph, says the approach moves tasking and stolen data through legitimate Microsoft Graph API traffic, so the activity looks like ordinary Microsoft 365 chatter and network controls keyed to attacker-owned destinations have nothing to flag.
The implant is a .NET DLL that supports just two commands, get and send, and it never reaches out to an attacker-owned server for payloads. Instead, it treats the compromised mailbox's calendar as a two-way dead drop.
To pull tasking, it queries the calendar for an event the operator has planted, buried at 2050-05-13, so the mailbox owner is unlikely to ever scroll to it, and reads its instructions from an attached file. To exfiltrate, it does the reverse: encrypts the stolen file, creates its own far-future event, and uploads the data as one or more attachments.
Everything moving through the calendar is wrapped in hybrid RSA and AES-256 encryption, with separate key pairs for incoming tasking and outgoing data.
