FlagThis

Abstract

HOLLOWGRAPH is a .NET malware linked to the Iranian-nexus Cavern backdoor framework that leverages the Microsoft Graph API to transform compromised Microsoft 365 calendars into a covert C2 channel. By hiding encrypted data in calendar events dated for the year 2050 and using IPv6 DNS tunneling for credential refreshes, the malware enables disciplined espionage against Israeli entities while evading traditional network defenses.