Executive Summary
Group-IB has uncovered HOLLOWGRAPH, a Windows malware attributed with high confidence to the Cavern backdoor framework and linked with low confidence to the Iranian-nexus actor Lyceum. The malware targets Israeli entities by abusing legitimate Microsoft Graph API infrastructure to conduct covert command-and-control (C2) operations through compromised Microsoft 365 accounts.
The attack chain involves the creation of calendar events dated far into the future (May 13, 2050) which act as a 'dead-drop' for tasking and exfiltration. Encrypted files are attached to these events, allowing the actor to blend in with legitimate enterprise cloud traffic. A secondary C2 channel uses DNS tunneling via IPv6 AAAA records to refresh Entra ID credentials, ensuring persistent access to the compromised mailbox.
This campaign represents a sophisticated espionage effort aimed at evading perimeter defenses. The selective nature of the targeting—with only 12 identified victims—suggests a disciplined adversary focused on high-value Israeli targets rather than broad opportunistic compromise.