HOLLOWGRAPH: Turning Microsoft 365 Calendars into Covert Command-and-Control Channels
Brief
Group-IB uncovers HOLLOWGRAPH, a Windows malware that abuses Microsoft Graph API to exfiltrate files and receive commands from the attacker using Microsoft 365 calendar events, and DNS tunneling to refresh credentials used in C2 communication.