Hackers Hide Malware Commands in Outlook Events Dated 2050 and Use as C2 Channel

A newly identified malware component linked to the Project CAV3RN framework is abusing Microsoft Outlook calendar events scheduled for 2050 to conceal command-and-control (C2) traffic. The tool also uses DNS AAAA responses as a fallback channel to restore Microsoft Graph credentials when cloud authentication fails.

Kaspersky researchers have associated the activity with highly targeted cyberespionage operations against Israeli organizations. While the broader CAV3RN ecosystem has been connected to Iran-nexus activity, the OilRig attribution remains assessed with low confidence by some researchers.

Outlook as a C2 Channel

The new communication module, identified as AzureCommunication.dll, appears designed to replace an earlier HTTP/WebSocket C2 component within CAV3RN’s modular architecture. It uses Microsoft Graph API access to a compromised Microsoft 365 mailbox, turning its default Outlook calendar into a two-way dead-drop channel.

Instead of contacting an obvious attacker-controlled server, the malware authenticates to Microsoft Entra ID using OAuth 2.0 application credentials. It then accesses calendar events through Microsoft Graph, allowing malicious traffic to blend with legitimate Microsoft 365 activity.

Commands, heartbeats, and stolen data are stored in a fixed calendar window: May 13, 2050, from 22:00 to 23:00 UTC. Placing events decades in the future reduces the likelihood that victims or administrators will encounter them in ordinary calendar views. Group-IB-linked reporting similarly described encrypted commands and data being hidden in calendar attachments scheduled for 2050.

For operator tasking, the malware searches calendar events using a subject formatted as Event ID: <agent-id>. It downloads attached command data, decrypts it, and deletes the event after retrieving it.

The malware uses hybrid encryption for inbound commands: an RSA-encrypted AES key protects an AES-256-GCM encrypted payload. This approach gives operators confidentiality and integrity protection while using a legitimate cloud platform as the transport layer.

When sending results, the implant creates a temporary calendar event, uploads encrypted output in attachments of up to 10 MB, then changes the subject to Boss Report ID: <agent-id>1500.

The capitalization difference between inbound file0.txt and outbound File0.txt attachment names may provide defenders with a useful hunting clue.

The framework also creates and replaces heartbeat events labelled Boss update ID: <agent-id>1500, enabling operators to track active implants without direct C2 infrastructure.

If Microsoft Graph token acquisition or tenant validation fails, AzureCommunication.dll switches to a DNS-based recovery process. It queries actor-controlled DNS infrastructure using AAAA records, treating IPv6 addresses as containers for configuration fragments rather than network destinations.

The malware retrieves updated information, including Microsoft Entra tenant IDs, client IDs, client secrets, and target mailbox addresses in 14-byte segments. Each query contains a hex-encoded agent identifier, which enables the operator-controlled authoritative DNS server to customize responses for each specific victim, as noted in a report by Kaspersky shared with CybersecurityNews.

This fallback design is significant because it lets attackers repair their cloud C2 configuration without deploying an updated malware payload. Reporting on HollowGraph likewise identified DNS tunneling over IPv6 AAAA records to refresh Entra ID credentials used for Microsoft Graph C2.

Takeaway for Defenders

Organizations should investigate unusual application activity involving Microsoft Graph calendar operations, particularly when a service principal creates, modifies, deletes, or attaches files to calendar events without a clear business purpose.

Analysts should review Microsoft 365 audit logs for events dated far in the future, suspicious subjects such as Event ID:, Boss update ID:, and Boss Report ID:, and recurring activity tied to a single mailbox.

Defenders should also monitor DNS AAAA queries for cloudlanecdn[.]com, especially subdomains containing long hexadecimal strings and numeric fields.

The campaign demonstrates how threat actors can repurpose trusted SaaS platforms and DNS infrastructure to make C2 communications harder to distinguish from normal enterprise traffic.

The Privilege Paths Attackers See That You Don’t: BeyondTrust Pathfinder Platform Does It for You -> Get Free Identity Security Assessment