Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
4 IOCs
Hackers Use Microsoft 365 Calendar Events as Dead Drops for Malware Commands
Threat Actors
Excerpt
A newly identified Windows malware sample, dubbed HOLLOWGRAPH, is abusing the Microsoft Graph API to turn a compromised Microsoft 365 calendar into a covert two-way command-and-control channel. Group-IB attributes the malware, with high confidence, to the Iranian-linked Cavern backdoor framework , and says it communicates through a compromised Microsoft 365 account in Israel, blending its traffic into legitimate enterprise communications. HOLLOWGRAPH is a .NET…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(1)
Capability
Victim
Indicators of Compromise
Open the mindmap →4 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | f3f3006f8304788251b153d53b305322b8acab0c66ec816b8d9f101bcc851da3 | Medium | Score 53/100 | First seen |
| SHA256 | b3d0f6e4e3be395fd7cf9e8101c89963d77216578cbb117a6ac9bc3564485eff | Medium | Score 53/100 | First seen |
| SHA256 | 75e51774b8f79e5f256eaae639635f911b3e744d4774fd6068dd980255621509 | Medium | Score 53/100 | First seen |
| Domain | cloudlanecdn.com | High | Score 72/100 | First seen |
IOC Relationship Graph
Building graph…