A new type of malware, dubbed HollowGraph, has been identified exploiting Microsoft 365 calendars to conduct espionage operations. The malicious software manipulates calendar events, setting them far into the future, specifically to the year 2050, to avoid detection while using these events to exchange stolen data and commands.
How HollowGraph Operates
The cybersecurity firm Group-IB has brought to light this innovative method, where the malware leverages legitimate Microsoft Graph API traffic to mask its activities as normal Microsoft 365 usage. The malware, a .NET DLL, executes two primary commands: ‘get’ and ‘send’. It uses the compromised calendar as a medium for exchanging information, eliminating the need to connect with an attacker-controlled server for instructions.
To receive commands, HollowGraph queries for an event dated 2050-05-13, ensuring it remains unnoticed in the mailbox. Instructions are embedded in this event as attachments. For data exfiltration, the malware encrypts stolen data, creates a similar future-dated event, and uploads the encrypted files as attachments.
Encryption and Persistence Mechanisms
All data moving through the calendar is secured using hybrid RSA and AES-256 encryption, with separate keys for incoming and outgoing data. Additionally, HollowGraph sustains its access by refreshing its application credentials through DNS, using values decoded from IPv6 records returned by a malicious domain. These credentials are stored in a file disguised as a regular log, keeping the malware’s operations under the radar.
Despite its sophistication, the malware maintains clear communication channels, making it challenging to detect. Group-IB associates HollowGraph with the Cavern backdoor framework, linked to Iranian cyber actors, but stops short of directly attributing it to any specific group.
Detection and Security Measures
HollowGraph’s stealthy use of Microsoft services poses a significant detection challenge. Group-IB suggests monitoring calendar events for unusual characteristics, such as future dates and specific naming patterns, to identify potential indicators of compromise.
On the security front, Group-IB advises organizations to restrict and audit OAuth applications with access to Microsoft Graph, ensuring robust identity management practices. It’s crucial to monitor for unexpected application-driven changes within Microsoft 365 environments and watch for unusual DNS queries that might signal malicious activity.
While HollowGraph is not exploiting any specific software vulnerability, the campaign underscores the importance of vigilant identity and application permission monitoring. As the malware remains active, organizations are encouraged to review their detection strategies and bolster their defenses against such innovative threats.
