TLDR Tech / InfoSec
This Iranian Malware Has No C2 Server to Block. The Command Channel Is a Meeting Invite in Your Own Calendar
HollowGraph is an Iranian-nexus malware tied to the Cavern backdoor framework that runs no command-and-control infrastructure at all and instead reads orders from and writes stolen data into a victim's own Microsoft 365 calendar over the legitimate Graph API. The implant encrypted its traffic with a hybrid RSA plus AES-256-GCM scheme using separate key pairs per direction and exfiltrated Entra ID credentials via DNS tunneling. Group-IB counted twelve infected Israeli systems active between June 3 and July 9. It linked the malware to the Lyceum espionage cluster, and Check Point separately documented the same Cavern framework this month under the name Cavern Manticore.
Read the full story