Calendar events scheduled to far-future date 2050-05-13 (HOLLOWGRAPH C2 concealment)

Ethan Andrews@eandrews

•updated Jul 29, 2026•37•0•25

Detects Office 365 calendar events created or modified with a specific far-future date (2050-05-13) or dates scheduled more than 10 years into the future. This behavior is associated with the HOLLOWGRAPH backdoor, which uses calendar items as a C2 channel to hide tasking or exfiltration events from the mailbox owner.