MalwareBleeping Computer
8.0 — CRITICAL
New HollowGraph malware uses Microsoft Graph for stealthy C2 comms
A malicious component dubbed HollowGraph uses the calendar feature in compromised Microsoft 365 mailboxes as a command-and-control channel to receive attacker commands and exfiltrate stolen data. [...]
🤖 AI BriefingAuto-generated threat analysis
🔍Threat Overview
HollowGraph malware uses Microsoft Graph for stealthy C2 communications, targeting organizations in Israel with espionage purposes. The threat actor's technical sophistication and operational maturity suggest significant capabilities.
⚙️Technical Details
Affected Systems
Compromised Microsoft 365 mailboxes
Attack Vectors
Microsoft Graph API via a compromised Microsoft 365 accountDNS tunnelling for credential refreshCalendar events with stolen files in encrypted form and search for new ones with instructions from the threat actor
💥Impact Assessment
Severity: high
Who Is at Risk
Organizations in IsraelEntities targeted by the Iranian-nexus threat actor Lyceum (linked to Cavern framework)Severity: high
🛡️Recommended Actions
1Monitor Microsoft Graph and Microsoft 365 audit logs for suspicious application-driven calendar activity
2Enforce Conditional Access, restrict and audit OAuth client-credential applications
3Monitor outbound DNS for tunneling patterns
📦Affected Products
Microsoft 365 mailboxes
Read the full article
This is a curated summary. The complete article is available at Bleeping Computer.