This Iranian Malware Has No C2 Server to Block. The Command Channel Is a Meeting Invite in Your Own Calendar.
- Patrick Duggan
- 9 hours ago
- 5 min read
There is nothing to add to a blocklist here, and that is the entire point.
Group-IB disclosed a piece of Iranian-nexus malware called HollowGraph that has no command-and-control server. Not a hidden one, not a fast-flux one — none. It never sends a packet to attacker infrastructure. It reads its orders out of, and writes its stolen data back into, the victim's own Microsoft 365 calendar, over the legitimate Microsoft Graph API, using the victim's own credentials. The operator plants a meeting invite. The implant reads it. The answer goes back as another appointment. To your network monitoring it is Outlook talking to Microsoft, which is what Outlook does all day.
Why this is the shape we keep warning about
We have a name for the class of attack that wins by removing the thing your defense is looking for. We call it the subtraction attack, and HollowGraph is a clean specimen. Your entire detection posture for C2 assumes there is a C2 — an IP, a domain, a beacon interval, a JA3 fingerprint, something that leaves your network headed somewhere it shouldn't. HollowGraph deletes that assumption. There is no outbound connection to a bad place because every connection goes to Microsoft, and Microsoft is not a bad place.
It is also a dead drop, in the oldest tradecraft sense. A dead drop is a location both parties trust and neither has to meet at — a loose brick, a park bench. The spy leaves the message; the handler collects it later; they are never in the same place at the same time. A calendar appointment in a tenant both the implant and the operator can reach is a digital loose brick. We have written about this pattern when the dead drop was a blockchain address and when it was a compromised web service. The move is always the same: don't build infrastructure that can be seized and blocked, borrow infrastructure that can't. HollowGraph borrows the most trusted infrastructure in the modern enterprise — the one you cannot block without turning off email.
The mechanics, because they matter
The implant uses the Microsoft Graph API to turn a compromised mailbox's calendar into a two-way channel. Commands arrive as appointments carrying encrypted attachments; results go back the same way. The crypto is not an afterthought — a hybrid RSA plus AES-256-GCM scheme with a separate key pair for each direction, which is more operational discipline than most commercial software ships with. Credentials for Microsoft Entra ID, the identity layer formerly called Azure AD, are exfiltrated over DNS tunneling. One observed command, 003, simply toggles the implant's own debug logging — the mundane housekeeping of a mature framework, not a smash-and-grab.
Group-IB counted twelve infected systems, all Israeli entities, with communication running from June 3 to at least July 9, 2026.
Who this is
Group-IB attributes HollowGraph to the Cavern backdoor framework and notes technical overlap with Lyceum — the Iranian MOIS-adjacent espionage cluster we already track in our adversary index alongside MuddyWater, MAGNALLIUM, and CopyKittens. Check Point documented the same Cavern framework earlier this month in the hands of a group it named Cavern Manticore, likewise aimed at Israeli organizations and their IT providers.
So the frame is not a lone piece of malware. It is a MOIS-affiliated engineering effort that ships a modular, multi-format C2 framework, and HollowGraph is the transport module that solved the hardest problem an espionage operator has: how to talk to your implant without owning any infrastructure a defender can find. This is our standing Iran watch — CyberAv3ngers for breaking operational technology, Handala for wiping and leaking, and now the Cavern cluster for patient, infrastructure-less espionage — and it is a software organization with a roadmap, not a hacktivist crew.
The honest part about our own defenses
We run a mail-tier blocking product that pushes our threat feed into Microsoft's Tenant Allow/Block List. It would not catch this, and I would rather say so than imply otherwise. HollowGraph sends no malicious mail. It does not phish a link or attach a payload for a mail filter to inspect. It rides authenticated Graph API calls against the calendar object. Mail-tier defense, ours included, watches the wrong door for this one.
That is not a weakness to hide; it is the reason the technique exists. It was built specifically to slip between the network monitor that watches outbound connections and the mail filter that watches inbound messages, by living in the seam where a trusted first-party API moves data neither tool inspects.
What to actually do
There is no indicator to block, so detection moves up a layer, from what left the network to what the identity did. The signal HollowGraph cannot hide is behavioral, in your Microsoft 365 audit and Graph sign-in logs:
A service or session creating, reading, and deleting calendar appointments through the Graph API at machine cadence rather than human cadence. Calendar events carrying binary or base64 attachments that no human would attach to a meeting. Graph API access from a token or location that does not match the user's normal pattern. And, separately, DNS queries with the payload-shaped subdomains of tunneling — the one place this actor does touch the network, to carry Entra ID credentials out.
If you are an IT or managed-service provider with customers an intelligence service cares about, assume the Cavern cluster is modeling exactly the trusted path from your tenant into theirs. The question for your Microsoft 365 posture is no longer only "what mail did we block" but "who is driving the Graph API, and does the rhythm look human."
We hold this at 95 percent as we hold everything — the malware analysis and attribution are Group-IB's and Check Point's research, corroborated by the trade press, not our own capture, and we say so. But the shape is ours on the record: the C2 monoculture is over, the trusted first-party API is the new dead drop, and the attack that leaves nothing to block is the one you have to detect by behavior instead. There is no IOC to feed here, and this time that absence is the whole story.
Sources: Group-IB, HollowGraph disclosure (July 2026), via Infosecurity Magazine; Check Point Research, "Cavern Manticore" (July 2026). DugganUSA adversary index for Lyceum / MuddyWater / MAGNALLIUM tracking. No network indicators exist for this campaign by design — the command channel lives entirely inside the victim's own Microsoft 365 tenant.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.