The HOLLOWGRAPH malware, linked to Iranian espionage activity, uses Microsoft 365 calendars as a covert command-and-control channel by hiding instructions and exfiltrated data within calendar appointments, often dated far into the future.
Microsoft 365 calendars have become a hiding place for espionage malware, with commands and stolen files stashed inside appointments dated to the year 2050, researchers from Group-IB discovered. Targeted campaign tied to Iranian espionage activity The malware, which Group-IB calls HOLLOWGRAPH, is one component of a bigger toolkit the company links with high confidence to the Cavern backdoor framework, a modular espionage toolkit built from separate plugins that each handle a different task, previously tied … More → The post HOLLOWGRAPH malware turns Microsoft 365 calendars into an espionage channel appeared first on Help Net Security .