Home / Technology / Malware Hides in Future Calendars, Steals Data
Malware Hides in Future Calendars, Steals Data
21 Jul
Summary
- New malware uses future calendar entries for instructions.
- Data is encrypted and attached to calendar events for exfiltration.
- At least 12 Israeli entities were compromised by this malware.
Cybercriminals have developed a novel malware strain named HollowGraph that leverages compromised Microsoft 365 calendars for covert communication. This malware targets Israeli entities, with at least 12 systems confirmed to be compromised. Attackers hide malicious instructions within future calendar entries, often set for the year 2050, to evade detection.
Once inside a compromised system, HollowGraph utilizes the Microsoft Graph API to access and manipulate calendar events. It exfiltrates sensitive files by encrypting them and attaching the encrypted data to these calendar events. This method allows the stolen data to be transmitted disguised as routine calendar traffic, making it difficult for security defenses to identify.
While the researchers noted technical similarities with malware used by the Lyceum threat actor, definitive attribution remains uncertain due to low confidence in the overlap. Investigations identified three actively compromised systems still communicating with the attackers' infrastructure during the analysis period.
