TLDR Tech / InfoSec
Microsoft 365 calendars become spy drop boxes in HOLLOWGRAPH campaign
The HOLLOWGRAPH campaign utilizes Microsoft 365 calendar events, dated May 13, 2050, to conceal commands and store stolen files. It also refreshes Entra ID credentials via DNS tunneling. Group-IB has attributed this to the Cavern framework, identifying 12 compromised systems and tracing the command mailbox to an Israeli organization.
Read the full story