The Group-IB Threat Intelligence team has identified HOLLOWGRAPH, a new malware sample that we attribute, with high confidence, to the Cavern backdoor framework. This malware is one component of a larger toolkit, and it uses the Microsoft Graph API through a compromised Microsoft 365 account observed in Israel to communicate with its operators — a technique that helps conceal command-and-control traffic within legitimate Microsoft 365 communications.
The malware supports just two commands, get and send, and executes both exclusively through trusted Microsoft cloud infrastructure. Using the Microsoft Graph API, it treats the compromised mailbox’s calendar as a two-way dead-drop: operators plant tasking as calendar events, and the implant exfiltrates stolen files by creating its own events with encrypted data attached. To avoid catching the mailbox owner’s attention, every event is dated far into the future — 13 May 2050 — with payloads attached as files to the event.
Read more…
Source: Group-IB
Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox
Related:
- North Korean hackers blamed for stealing record $6.3B in Binance breach
October 30, 2026
Hackers working for the North Korean regime have been blamed for a record cryptocurrency heist following a cyberattack at crypto exchange Binance. The hackers stole at least $6.3 billion in crypto from the company’s wallets, though about half of that amount was frozen as the stolen crypto traveled across various blockchains, according to security researchers. The ...
- Kaspersky GReAT uncovers attack targeting government-only Windows system in Asia
October 29, 2026
Kaspersky’s Global Research and Analysis Team (GReAT) has uncovered an attack targeting a customized version of Windows 10 used exclusively by government organizations in an Asian country. The attackers used legitimate software components to launch NetamLoader, a previously unknown malware framework that can receive and run additional code while concealing its activity. The team presented ...
- Hackers are breaking into company networks via hacked CCTV camera software
October 29, 2026
Attackers abused camera management software to gain initial access and establish persistence on networks. Campaign used DLL sideloading and reverse shells to evade detection and maintain control. Researchers urge treating camera systems as security-sensitive assets and monitoring them for abnormal activity. Read more… Source: Sign up for the Cyber Security Review Newsletter The latest cyber security news and insights delivered ...
- Hacker stole personnel data about thousands of Homeland Security employees, including CBP and ICE agents
October 28, 2026
Personally identifiable information belonging to thousands of U.S. Department of Homeland Security employees has been published online after a hacker stole reams of data in a previously undisclosed breach at the government department earlier this year. The breach includes names, job titles, and work contact information, such as email addresses, cell phone numbers, and office locations, ...
- A security flaw in these widely used barcode scanners could open up warehouses and stores to cyberattack
October 28, 2026
Researchers find Bluetooth flaws in warehouse barcode scanners that could provide a foothold into enterprise networks. Attackers could spoof scanner input, inject keystrokes, and potentially pivot to ransomware or data theft. Kaspersky urges stronger device authentication, network segmentation, and stricter security controls for warehouse infrastructure. Read more… Source: TechRadar News Sign up for the Cyber Security Review Newsletter The latest cyber ...
- Rogue AI agent engages ‘Skynet mode’ to search the internet for exposed LLMs to hijack and run malware attacks
October 26, 2026
Researchers uncovered an autonomous AI attack campaign that hijacks exposed AI agents and infrastructure. The malicious “Skynet” agent deployed cryptominers, stole credentials, and recruited new AI systems autonomously. Security teams are urged to secure AI endpoints, restrict permissions, and protect high-value API keys. Read more… Source: TechRadar News Sign up for the Cyber Security Review Newsletter The latest cyber security news ...