HOLLOWGRAPH Backdoor Turns Microsoft 365 Calendars Into a C2 Channel

HOLLOWGRAPH is a Windows espionage backdoor distributed as a .NET NativeAOT DLL masquerading as a Brotli library that avoids traditional C2 by abusing a compromised Microsoft 365 mailbox calendar as a dead-drop (operator tasking via calendar event attachments and exfiltration via encrypted attachments). It uses RSA-OAEP and AES-256-GCM with directional key separation, and maintains access by pulling refreshed Entra ID credentials via DNS AAAA queries to an attacker-controlled domain; the report includes operational details, example Graph API calls, the DNS chunking scheme, and guidance to simulate the attack with the Picus Platform.