Outlook Vulnerability Lets Attackers Hide C2 in Calendar Events

Key Takeaways

• A new component of the Project CAV3RN cyberespionage framework is leveraging Microsoft Outlook calendar events to conceal command-and-control (C2) communications.
• The malware, dubbed AzureCommunication.dll, uses Microsoft Graph API to create and modify calendar events scheduled for the year 2050, making detection difficult.
• A sophisticated DNS AAAA record fallback mechanism is employed to restore Microsoft Graph credentials if cloud authentication fails, ensuring persistent access.
• The attacks are highly targeted against Israeli organizations, linked to broader cyberespionage activities.

A sophisticated new malware component, part of the Project CAV3RN framework, has been identified exploiting Microsoft Outlook calendar events to hide its command-and-control (C2) traffic. This advanced technique schedules malicious events decades into the future, specifically for May 13, 2050, from 22:00 to 23:00 UTC, to evade detection by administrators and automated monitoring systems.

Researchers at Kaspersky have connected this activity to highly focused cyberespionage operations primarily targeting organizations within Israel. While the larger CAV3RN framework has sometimes been associated with threat actors linked to Iran, the specific attribution to the OilRig group remains an area of low confidence among some researchers.

Outlook as a Covert C2 Channel

The recently discovered communication module, named AzureCommunication.dll, is believed to be a replacement for an older HTTP/WebSocket C2 component within CAV3RN’s modular design. It establishes a two-way dead-drop communication channel by gaining access to a compromised Microsoft 365 mailbox via the Microsoft Graph API, effectively turning the default Outlook calendar into a covert communication hub.

Instead of connecting to an easily identifiable attacker-controlled server, the malware authenticates with Microsoft Entra ID using OAuth 2.0 application credentials. This allows it to interact with calendar events through Microsoft Graph, enabling malicious traffic to seamlessly blend with legitimate Microsoft 365 activities.

Commands, operational heartbeats, and exfiltrated data are meticulously stored within a specific calendar window in 2050. This strategy of placing events far into the future significantly reduces the likelihood of victims or IT administrators encountering them during routine calendar reviews. Similar reports, including those linked to Group-IB, have also detailed the use of calendar attachments scheduled for 2050 to hide encrypted commands and data.

Command Execution and Data Exfiltration

To receive tasks, the malware searches for calendar events with a subject line formatted as Event ID: <agent-id>. Upon locating a task, it downloads the attached command data, decrypts it, and then deletes the event to cover its tracks.

Inbound commands utilize a hybrid encryption scheme: an AES key, encrypted with RSA, protects a payload encrypted with AES-256-GCM. This robust approach ensures both confidentiality and integrity for operator commands while leveraging a legitimate cloud platform for transport.

When transmitting results, the implant generates a temporary calendar event, uploads encrypted output in attachments up to 10 MB, and then modifies the subject line to Boss Report ID: <agent-id>1500. A subtle but potentially useful defensive clue is the difference in capitalization between inbound file0.txt and outbound File0.txt attachment names.

The framework also creates and updates heartbeat events labeled Boss update ID: <agent-id>1500. These events allow operators to monitor the status of active implants without requiring direct C2 infrastructure.

DNS Fallback Mechanism

Should the acquisition of Microsoft Graph tokens or tenant validation fail, AzureCommunication.dll is designed to switch to a sophisticated DNS-based recovery process. It queries actor-controlled DNS infrastructure using AAAA records, treating the IPv6 addresses not as network destinations but as containers for configuration fragments.

The malware retrieves updated information, including Microsoft Entra tenant IDs, client IDs, client secrets, and target mailbox addresses, in 14-byte segments. Each query includes a hex-encoded agent identifier, allowing the operator’s authoritative DNS server to provide customized responses for individual victims, as noted in a report by Kaspersky. This intelligent fallback mechanism is crucial as it enables attackers to repair their cloud C2 configuration without needing to deploy a new malware payload. Similar DNS tunneling over IPv6 AAAA records to refresh Entra ID credentials for Microsoft Graph C2 has also been observed in reporting on HollowGraph.

What You Should Do

• Investigate any unusual application activity involving Microsoft Graph calendar operations, especially if a service principal is creating, modifying, deleting, or attaching files to calendar events without a clear business justification.
• Review Microsoft 365 audit logs for events dated far in the future, suspicious subject lines such as Event ID:, Boss update ID:, and Boss Report ID:, and recurring activity tied to a single mailbox.
• Monitor DNS AAAA queries for the domain cloudlanecdn[.]com, paying close attention to subdomains containing long hexadecimal strings and numeric fields, as these may indicate C2 activity.
• Implement robust monitoring for abnormal access patterns to Microsoft Graph APIs, particularly those involving calendar functions.
• Educate users and administrators about the potential for legitimate cloud services to be repurposed for malicious activities, emphasizing the need for vigilance beyond traditional network perimeter defenses.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.