As reported by BleepingComputer, a newly identified malicious component called HollowGraph is abusing Microsoft 365 calendar functionality — accessed via the Microsoft Graph API — to establish a stealthy command-and-control channel. This technique represents a maturation of a threat tradecraft trend that should concern every enterprise security team running Microsoft 365 workloads.

Threat Alert: This technique represents a maturation of a threat tradecraft trend that should concern every enterprise security team running Microsoft 365 workloads.

Why This Technique Is Particularly Dangerous

Living-off-the-cloud (LotC) is rapidly becoming the offensive equivalent of living-off-the-land (LotL). Just as attackers learned to weaponize PowerShell, WMI, and other built-in OS tools to evade endpoint detection, they are now repurposing trusted cloud services — particularly Microsoft Graph — to route malicious communications through infrastructure that most organizations whitelist by default.

The core problem is one of signal dilution. Microsoft Graph API traffic is ubiquitous in modern enterprise environments. Security teams cannot simply block it without breaking legitimate business functionality. This gives threat actors a near-perfect cover channel: C2 communications that look indistinguishable from routine calendar sync operations at the network layer.

Shield53 Assessment: Perimeter-based controls — firewalls, web proxies, even most SASE solutions — will provide essentially zero visibility into this C2 mechanism unless they are specifically instrumenting Microsoft Graph API call patterns at a semantic level.

Who Is Most Exposed

The organizations at highest risk are those that have:

Why This Technique Is Particularly Dangerous
Heavily adopted Microsoft 365 without implementing advanced audit logging or Microsoft Purview Audit (Premium)
Limited visibility into OAuth app registrations and delegated permissions granted within their tenant
No behavioral analytics baseline for Microsoft Graph API usage per user or per application
Overprovisioned service accounts or legacy app registrations with broad Calendar.ReadWrite permissions

Mid-market enterprises are disproportionately exposed here. Larger organizations with mature identity security programs and Microsoft Sentinel deployments will have better telemetry, but smaller teams often lack the engineering capacity to write and maintain Graph API anomaly detection rules.

The Broader Trend: Cloud APIs as C2 Infrastructure

HollowGraph is not an isolated innovation. We have seen prior use of OneDrive, SharePoint, Slack, Dropbox, and even Google Sheets as C2 conduits by both nation-state actors and sophisticated criminal groups. The common thread is the exploitation of trusted, high-volume SaaS services that bypass traditional threat intelligence feeds — no malicious domain to block, no suspicious IP to sinkhole.

What makes the Microsoft Graph vector particularly attractive is the richness of the API surface. An attacker with a compromised access token can read and write calendar events, emails, Teams messages, files, and contacts — all through a single authenticated endpoint. The exfiltration and command delivery mechanisms are nearly unlimited once initial access is achieved.

Shield53 Recommendations

Immediate Actions

  • Audit OAuth app registrations: Review all applications in your Azure AD / Entra ID tenant with Calendar.Read, Calendar.ReadWrite, or Mail.ReadWrite delegated or application permissions. Revoke anything unrecognized or unnecessary.
  • Enable Microsoft Purview Audit (Premium): Ensure mailbox audit logging captures MailItemsAccessed and Graph API access events. Standard audit logging does not provide sufficient granularity.
  • Deploy Conditional Access App Control: Restrict which registered applications can access Graph API endpoints, particularly for sensitive workloads like calendar and mail.
  • Hunt for anomalous Graph API patterns: Use Microsoft Sentinel or your SIEM to baseline normal Graph API call volumes per user/app and alert on deviations — especially calendar write operations from non-standard client applications.

Longer-Term Defensive Posture

  • Implement Continuous Access Evaluation (CAE) to reduce token lifetime and limit attacker dwell time after credential compromise.
  • Adopt a Zero Standing Permissions model for service accounts interacting with Microsoft Graph — use Privileged Identity Management (PIM) to require just-in-time access.
  • Integrate Microsoft Defender for Cloud Apps (formerly MCAS) policies that alert on unusual OAuth consent grants and abnormal API activity patterns.
  • Include Graph API C2 scenarios in your purple team exercises — most red team assessments still focus on network-layer C2 and will miss this detection gap entirely.

HollowGraph is a signal that the battleground for C2 detection has permanently shifted into the cloud control plane. Organizations that haven't invested in identity-centric detection capabilities — not just endpoint and network — are operating with a significant and growing blind spot.