Full Report
Group-IB uncovers HOLLOWGRAPH, a Windows malware that abuses Microsoft Graph API to exfiltrate files and receive commands from the attacker using Microsoft 365 calendar events, and DNS tunneling to refresh credentials used in C2 communication.
Analysis Summary
# Tool/Technique: HOLLOWGRAPH
## Overview
HOLLOWGRAPH is a sophisticated Windows-based malware discovered by Group-IB. Its primary purpose is the exfiltration of sensitive files and the execution of remote commands. It is notable for its stealthy Command and Control (C2) mechanism, which abuses the **Microsoft Graph API** to communicate via Microsoft 365 calendar events and utilizes **DNS tunneling** to maintain and refresh its access credentials.
## Technical Details
- **Type:** Malware family
- **Platform:** Windows
- **Capabilities:** File exfiltration, remote command execution, credential refreshing via DNS tunneling, C2 via legitimate cloud services (Microsoft 365).
- **First Seen:** Reported by Group-IB in 2024 (Analysis based on events dated through 2050 in malicious calendar entries).
## MITRE ATT&CK Mapping
- **TA0011 - Command and Control**
- **T1102.002** - Web Service: Bidirectional Communication (Microsoft Graph API)
- **T1573.002** - Encrypted Channel: Digital Certificates
- **T1132.001** - Data Encoding: Standard Encoding
- **TA0010 - Exfiltration**
- **T1567.002** - Exfiltration Over Web Service: Exfiltration to Cloud Storage
- **TA0003 - Persistence**
- **T1133** - External Remote Services
- **TA0005 - Defense Evasion**
- **T1071.004** - Application Layer Protocol: DNS (Tunneling)
## Functionality
### Core Capabilities
- **Microsoft Graph API Exploitation:** Uses the Graph API to interact with a compromised or attacker-controlled Microsoft 365 environment.
- **Calendar-Based C2:** Receives instructions and payloads by monitoring Microsoft 365 calendar events. Attackers place commands within event descriptions or attachments.
- **Data Exfiltration:** Uploads stolen files as attachments to specific calendar events, disguising exfiltration as legitimate office productivity traffic.
### Advanced Features
- **DNS Tunneling for Credential Refresh:** Employs DNS tunneling (specifically utilizing AAAA/IPv6 queries) to receive updated OAuth2 tokens or client secrets. This ensures C2 continuity even if initial credentials are revoked or expire.
- **Stealthy Scheduling:** Malicious calendar events are often set to far-future dates (e.g., year 2050) to avoid appearing in the victim’s immediate notification view.
- **GUID-based Identification:** Uses GUID-only subjects and specific string patterns (e.g., `Boss{..}ID{..}`) to identify and parse command instructions.
## Indicators of Compromise
- **File Hashes (SHA256):**
- `75e51774b8f79e5f256eaae639635f911b3e744d4774fd6068dd980255621509`
- `f3f3006f8304788251b153d53b305322b8acab0c66ec816b8d9f101bcc851da3`
- `b3d0f6e4e3be395fd7cf9e8101c89963d77216578cbb117a6ac9bc3564485eff`
- **Network Indicators:**
- `cloudlanecdn[.]com` (Defanged)
- **Behavioral Indicators:**
- High frequency of AAAA DNS queries to unusual or high-entropy subdomains.
- Unexpected process interaction with `graph.microsoft.com`.
- Creation of hidden or far-future calendar events in Outlook/M365.
## Associated Threat Actors
- Currently not publicly attributed to a specific named group, though the sophistication suggests an Advanced Persistent Threat (APT) actor.
## Detection Methods
- **Behavioral Detection:**
- Monitor for unusual volume of DNS traffic, specifically AAAA records with long, randomized subdomains (indicative of tunneling).
- Audit Microsoft Graph API calls from non-standard applications or processes.
- **M365 Hunting:**
- Scan user calendars for events scheduled in the distant future (e.g., year 2050).
- Search for calendar attachments with naming conventions like `File{n}.txt`.
- **SIEM/EDR Alerting:**
- Alert on the creation of new OAuth2 client secrets or anomalous token usage in Entra ID (formerly Azure AD).
## Mitigation Strategies
- **OAuth2 Governance:** Restrict and audit the registration of new applications in Entra ID. Implement "least privilege" for API permissions (avoid `Calendars.ReadWrite.All` if not strictly necessary).
- **DNS Security:** Implement DNS filtering and inspection. Block or alert on known DNS tunneling patterns.
- **Conditional Access:** Enforce strict Conditional Access policies for all users, requiring MFA and compliant devices for M365 access.
- **Credential Rotation:** Regularly rotate service principal secrets and monitor for anomalous token generation.
## Related Tools/Techniques
- **Graphican:** Another malware family known to use Microsoft Graph API for C2.
- **DNSExfiltrator:** A tool commonly used for testing DNS-based data theft.
- **Living off Trusted Services (LOTS):** The broader technique of using legitimate cloud providers (Google Drive, Dropbox, Microsoft 365) to hide malicious activity.