HOLLOWGRAPH Backdoor Turns Microsoft 365 Calendars Into a C2 Channel

HOLLOWGRAPH Backdoor Turns Microsoft 365 Calendars Into a C2 Channel

Umut Bayram

| 8 MIN READ

| July 29, 2026

Summarize with:

ChatGPT

perplexity

Google AI

Key Takeaways

HOLLOWGRAPH is a Windows espionage backdoor delivered as a .NET NativeAOT DLL masquerading as a Brotli library.

It uses compromised Microsoft 365 calendar events as a two-way dead drop for tasking and exfiltration.

Hybrid RSA-OAEP and AES-256-GCM encryption protects Graph payloads, with separate RSA key pairs for each direction.

DNS tunneling over IPv6 AAAA records refreshes Entra ID credentials and preserves mailbox access after secret rotation.

Picus Platform lets teams simulate HOLLOWGRAPH attacks and validate security controls against the malware.

HOLLOWGRAPH is a Windows espionage backdoor, delivered as a .NET NativeAOT-compiled DLL , that was first observed in early June 2026 [1].

Its defining trait is that it never talks to an attacker-owned server for command or payload traffic. Instead, it abuses the Microsoft Graph API against a compromised Microsoft 365 mailbox and treats that mailbox's calendar as a two-way dead drop.

Operator tasking arrives as calendar events, stolen files leave as encrypted event attachments, and every event is stamped with a far-future date so it stays out of the mailbox owner's view.

In this analysis, we break down what HOLLOWGRAPH is and walk through how it operates at each stage of its execution flow. In the end, we will show how Picus Platform helps you validate your security controls against this threat.

HOLLOWGRAPH at a Glance

Attribute

Detail

Malware type

Backdoor and data-exfiltration implant (espionage)

First seen

June 2026

Target platform

Windows

File format

.NET NativeAOT-compiled DLL , masquerading as a Brotli library

Commands

get (retrieve tasking), send (exfiltrate files)

Primary C2 channel

Microsoft Graph API against a compromised Microsoft 365 mailbox calendar (dead drop)

Secondary channel

DNS tunneling over IPv6 AAAA records for credential and config refresh

Encryption

Hybrid RSA-OAEP 2048-bit plus AES-256-GCM , separate RSA key pairs per direction

What Is HOLLOWGRAPH Malware?

HOLLOWGRAPH is a Windows backdoor and data-exfiltration implant. Technically, it is a .NET assembly compiled with NativeAOT and shipped as a DLL , and it is loaded on the victim by a separate framework component that acts as the orchestrator.

On disk, the DLL masquerades as a Brotli compression library so it blends in with legitimate dependencies.

The implant is deliberately minimal. It exposes only two commands, get and send , and routes both through Microsoft's own cloud rather than through dedicated attacker infrastructure. This design lets its malicious activity ride inside ordinary enterprise Microsoft 365 traffic.

At its core, HOLLOWGRAPH does three things [1]:

Receives tasking through a dead drop. The get command reads operator commands hidden inside calendar events on a compromised Microsoft 365 mailbox.

Exfiltrates files through the same dead drop. The send command encrypts a target file and uploads it as one or more attachments on a newly created calendar event.

Keeps its cloud access alive. A DNS tunneling channel over the attacker domain cloudlanecdn[.]com pulls down fresh Microsoft Entra ID (Azure AD) credentials and rewrites them into a local configuration file, so that expired or defender-rotated secrets do not sever its access to the mailbox.

How Does HOLLOWGRAPH Malware Work?

HOLLOWGRAPH operates through three core mechanisms: a Graph API dead drop, hybrid encryption, and DNS-based credential refresh.

We will detail these mechanisms in the sections below.

Local Configuration

The binary carries a hardcoded configuration blob. On execution, it writes that configuration to disk as logAzure.txt , a filename chosen to pass as a normal log artifact. The DNS tunneling channel later overwrites individual fields in this same file as credentials rotate.

The configuration holds everything the implant needs to reach its Graph dead drop:

Entra ID Tenant ID : Azure AD tenant of the compromised mailbox.

Entra ID Client (Application) ID : OAuth2 application identity used for authentication.

Entra ID Client Secret : Secret paired with the client ID for client-credentials auth.

Target mailbox : Compromised Microsoft 365 mailbox used as the dead drop.

C2 DNS domain : cloudlanecdn[.]com , used for the DNS credential-refresh channel.

RSA public key (2048-bit) : wraps the per-file AES-256 key used to encrypt exfiltrated data before upload (outbound direction).

RSA private key (2048-bit) : unwraps the AES-256 key needed to decrypt operator tasking pulled from the calendar (inbound direction).

Hybrid Cryptography With Directional Key Separation

HOLLOWGRAPH protects all Graph payloads with a hybrid scheme.

RSA-OAEP (SHA-256) wraps a freshly generated AES-256 key , and the payload itself is sealed...