HollowGraph: The Spyware That Hides Its Orders in a Fake 2050 Calendar Invite

Key points

• Group-IB has identified a new espionage tool called HollowGraph that hides its instructions inside Microsoft 365 calendar events dated 13 May 2050.
• At least 12 systems have been infected, with 3 actively communicating with the attackers between 3 June and 9 July.
• The victims sit almost entirely inside Israel, pointing to a targeted spying operation.
• Group-IB assesses with high confidence that HollowGraph is part of the Cavern framework, and with lower confidence that it overlaps with the Iran-linked cluster tracked as Lyceum.
• The malware uses a second, quieter channel called DNS tunnelling, hiding fresh login details inside internet address lookups to a domain the attackers control.

A new piece of spy software is using a corner of Microsoft 365 almost nobody checks: the calendar.

Researchers at Group-IB, in work first reported by BleepingComputer, have named the tool HollowGraph. It is a quiet, patient piece of malicious code that hides on a victim's machine and takes its orders from meeting invites scheduled for the year 2050.

The idea is simple and, frankly, clever. Once the attackers have valid login details for a target's Microsoft 365 mailbox, HollowGraph reads and writes calendar events in that mailbox. The events are all dated 13 May 2050, in a one-hour window between 22:00 and 23:00 UTC. Attached to those far-future invites are small encrypted files. Some contain commands from the attackers. Others contain stolen documents on their way out.

Group-IB calls the calendar a "covert dead-drop". Nobody scrolls that far ahead. Nobody notices.

Who is behind it?

Group-IB stops short of naming a country. Its analysts say HollowGraph shares technical fingerprints with the Iran-nexus group tracked as Lyceum (also known as Hexane in some vendors' naming), but they rate that link at medium confidence at best. What they do say with high confidence is that HollowGraph is a module of a broader toolkit called Cavern, which has been tied in past reporting to Iranian operators focused on Israeli targets.

Capability is not the same as intent, and shared code is not the same as a shared operator. Treat the Lyceum overlap as a lead, not a verdict.

The victim set does the loudest talking. Nearly all infections sit inside Israeli organisations, and the operation is small and selective. That is the shape of an espionage job, not a smash-and-grab.

How the trick actually works

HollowGraph carries a small configuration file called logAzure.txt, disguised to look like an ordinary log. Inside are the credentials it needs to log into a compromised Microsoft 365 tenant through the Microsoft Graph API, the official channel companies use to build apps against their own mailboxes.

Because the traffic goes through Microsoft's own cloud, it looks legitimate to most security tools.

The malware supports only two commands. One tells it to check the calendar for new instructions. The other tells it to upload stolen files as calendar attachments, encrypted with the attackers' key. Everything is wrapped in a mix of RSA and AES-256-GCM encryption, meaning the inbound and outbound data are scrambled with separate keys so defenders cannot easily read either side.

There is a backup channel too. If the login details stop working, HollowGraph quietly asks the domain cloudlanecdn[.]com for fresh ones, using DNS tunnelling. That means hiding data inside the normal internet lookups computers perform thousands of times a day. Each response smuggles back 14 bytes of new configuration.

What defenders should look for

Group-IB recommends hunting through Microsoft Graph and Microsoft 365 audit logs for application-driven calendar activity, especially events scheduled far in the future or with odd subject lines and attachments. The presence of a logAzure.txt file, or DNS traffic to cloudlanecdn[.]com, is a strong signal.

Tighter controls help too: Conditional Access rules, strict auditing of OAuth applications that use client-credential logins, and outbound DNS monitoring to catch tunnelling patterns.

For ordinary staff, there is no phishing lure to spot here and no password to reset. This is a tool for people already inside. The lesson is for the security team: the attacker's mailbox is not just a target, it can be the command channel.