Executive Summary
HOLLOWGRAPH is a specialized Windows espionage backdoor, first observed in June 2026, designed to evade traditional network monitoring by routing its command-and-control (C2) traffic through legitimate Microsoft 365 services. The malware operates as a .NET NativeAOT-compiled DLL, masquerading as a legitimate Brotli compression library to blend into system environments.
Technically, the implant leverages the Microsoft Graph API to treat a compromised mailbox's calendar as a two-way dead drop for tasking and data exfiltration. It specifically targets a far-future date window (May 13, 2050) to hide its malicious calendar events from user view. Furthermore, it employs a sophisticated DNS tunneling mechanism over IPv6 AAAA records to refresh Entra ID credentials, ensuring persistent access even if secrets are rotated.
The use of legitimate cloud infrastructure for C2 makes detection challenging for standard perimeter defenses. Organizations relying on Microsoft 365 should monitor for unusual Graph API activity and suspicious DNS queries to external domains used for credential synchronization.