Top Tweets for #HollowGraph

22 days ago

Discover how the HollowGraph malware exploits Microsoft 365 calendars for C2 communication and data exfiltration in targeted espionage attacks. #HollowGraph #Microsoft365 #Malware #CyberEspionage #InfoSec #GroupIB https://t.co/WY6SXomPnM

421

Threat Intelligence @threatintel

22 days ago

#ThreatProtection #HollowGraph #malware leverages Microsoft 365 Calendar events for C2 communication, read more about Symantec's protection: https://t.co/3m9iM6Dj8B

Group-IB Global

@GroupIB

24 days ago

🚨 Threat actors continue to find new ways to hide malicious activity inside trusted enterprise services. Group-IB Threat Intelligence researchers have uncovered #HOLLOWGRAPH, a Windows malware linked with high confidence to the Cavern framework that abuses Microsoft Graph API and compromised #Microsoft365 accounts to establish a covert command-and-control channel. Key findings from our research: 🔹 Microsoft 365 calendars repurposed as two-way dead drops for command execution and data exfiltration 🔹 Commands and stolen files hidden inside encrypted calendar event attachments scheduled for the year 2050 🔹 DNS tunneling over IPv6 AAAA records used to refresh Microsoft Entra ID credentials required for cloud-based C2 communications 🔹 At least 12 identified victims, with telemetry suggesting a highly targeted operation focused on Israeli entities 🔹 Technical overlaps linking HOLLOWGRAPH to the broader Cavern framework As threat actors increasingly leverage legitimate cloud infrastructure to evade detection, defenders must expand visibility beyond traditional network indicators and monitor for abuse of trusted services. Read the full technical analysis: https://t.co/03zw7zjFUH #ThreatIntelligence #CyberSecurity #MalwareAnalysis #CloudSecurity

GroupIB's tweet photo. 🚨 Threat actors continue to find new ways to hide malicious activity inside trusted enterprise services.

Group-IB Threat Intelligence researchers have uncovered #HOLLOWGRAPH, a Windows malware linked with high confidence to the Cavern framework that abuses Microsoft Graph API and compromised #Microsoft365 accounts to establish a covert command-and-control channel.

Key findings from our research:
🔹 Microsoft 365 calendars repurposed as two-way dead drops for command execution and data exfiltration
🔹 Commands and stolen files hidden inside encrypted calendar event attachments scheduled for the year 2050
🔹 DNS tunneling over IPv6 AAAA records used to refresh Microsoft Entra ID credentials required for cloud-based C2 communications
🔹 At least 12 identified victims, with telemetry suggesting a highly targeted operation focused on Israeli entities
🔹 Technical overlaps linking HOLLOWGRAPH to the broader Cavern framework

As threat actors increasingly leverage legitimate cloud infrastructure to evade detection, defenders must expand visibility beyond traditional network indicators and monitor for abuse of trusted services.

Read the full technical analysis: https://t.co/03zw7zjFUH

#ThreatIntelligence #CyberSecurity #MalwareAnalysis #CloudSecurity

962

Group-IB Threat Intelligence

@GroupIB_TI

24 days ago

Instead of using traditional C2 infrastructure, #HOLLOWGRAPH stores operator tasking and stolen data inside calendar events scheduled for 13 May 2050. The implant retrieves commands from encrypted attachments and uploads exfiltrated files back to the same mailbox as File{n}.txt attachments, using separate RSA key pairs and AES-256-GCM encryption for each communication direction. Defenders should hunt for calendar events with Event ID: <taskid> {} subjects or the Boss{}ID{} naming convention. #ThreatIntel #APT

$GroupIB_TI's tweet photo. Instead of using traditional C2 infrastructure, #HOLLOWGRAPH stores operator tasking and stolen data inside calendar events scheduled for 13 May 2050. The implant retrieves commands from encrypted attachments and uploads exfiltrated files back to the same mailbox as File{n}.txt attachments, using separate RSA key pairs and AES-256-GCM encryption for each communication direction. Defenders should hunt for calendar events with Event ID: <taskid> {} subjects or the Boss{}ID{} naming convention. #ThreatIntel #APT$

333

Group-IB Threat Intelligence

@GroupIB_TI

24 days ago

#HOLLOWGRAPH is a newly identified Windows malware linked with high confidence to the Cavern framework. The #malware abuses Microsoft Graph API and a compromised #Microsoft365 mailbox, transforming the victim's calendar into a two-way dead drop for command-and-control and data exfiltration while blending malicious traffic into legitimate Microsoft cloud communications. #CyberSecurity

GroupIB_TI's tweet photo. #HOLLOWGRAPH is a newly identified Windows malware linked with high confidence to the Cavern framework. The #malware abuses Microsoft Graph API and a compromised #Microsoft365 mailbox, transforming the victim's calendar into a two-way dead drop for command-and-control and data exfiltration while blending malicious traffic into legitimate Microsoft cloud communications. #CyberSecurity

Amina Motala💫 @AminaMotala_

almost 5 years ago

Miami Crypto Experience 🌴☀️ @TimDraper #Vyfinance @MiamiCryptoExp Nov 10-12 #Bitcoin #hollowgraph

Top Tweets for #HollowGraph

Last Seen Hashtags on Sotwe

Trends for you

Most Popular Users