Hackers modified the calendar of MS365.

Hackers adapted the calendar of MS365 to channel commands to malware.

According to a report by the website, Cyber Security News has mentioned a vulnerability detection on the Microsoft 365 Calendar that can be used as a way to send commands received from C2 or Command and Control servers to the malware and use them as intermediaries to communicate from malware back to the server. This can be called a dead drop technique. The messages sent together are disguised as invites to participate in calendar events. All events are scheduled for the next 24 years, which is most likely. It was found to be scheduled for May 13, 2050, and it was so smooth that many users were unaware of it because the event was not found on the victim's calendar. A research team from Group-IB, a cybersecurity expert from Singapore, noted that the malware at this point also uses the channel to copy files stolen from the victim's machine (Exfiltration) in an invitation-attached file format, which is called malignant.

This malware is called HOLLOWGRAPH. It is a malware created with the .NET language that has the ability to use the Microsoft Graph API key after it has successfully hacked Microsoft 365 accounts. This malware has the support of only two instructions, get and send, to use the above command traffic. All data sent through the Microsoft Graph API is tightly encrypted with a hybrid encryption method between AES 256-GCM and RSA, so that it is called highly secure against detection.

In addition to the use of calendars as intermediaries, the HOLLOWGRAPH malware has also implemented another technique: creating a Tunnelling channel through DNS with IPv6 AAAA's Record Queries into a domain called "cloudlanecdn [.] com." This method allows the malware to quietly update the Microsoft Entra ID (Azure AD) login code and then smuggle the update into an harmless file called Azlogure.txt.

The research team has been very confident that the HOLLOWGRAPH malware is part of a backdoor framework called Cavern, a modular command and control toolkit that the research team from Check Point, another cybersecurity expert, recorded that the toolkit is associated with a cyberterrorist group from Iran called "Cavern Manticore," because the syntax of the command and many of the code are similar.

On the outbreak side, the research team determined that only 12 malware-infected machines were found, making it considered that the outbreak was not yet so large-scale that it was more likely to be a specific attack. It also suggested a way to determine if the machine was malware-infected or not. By searching for an event on the Microsoft 365 Calendar on 2050-05-13 with a blank GUID topic or with the "Event ID:" and "Boss {...} ID {...}" naming in conjunction with an attachment named File {n} .txt, which, if all this exists, means that the system is malware-infected.

# Trending # lemon 8 diary # Lemon 8 Howtoo # Ms365 # freedomhack