Insights, news, education and announcements from PolySwarm | cloud-native malware

HOLLOWGRAPH: The New Face of Cloud-Based Espionage

Jul 24, 2026 2:46:49 PM / by The Hivemind posted in Threat Bulletin, cyber espionage, cloud-native malware, Cavern framework, HOLLOWGRAPH, Microsoft Graph API malware, DNS tunneling, Microsoft 365 calendar malware

Regions Targeted: Israel
Related Families: HOLLOWGRAPH, Cavern Framework

Executive Summary

Industry researchers identified HOLLOWGRAPH, a newly discovered malware component that it attributes with high confidence to the Cavern backdoor framework. Rather than relying on traditional command-and-control (C2) infrastructure, HOLLOWGRAPH abuses the Microsoft Graph API to transform a compromised Microsoft 365 calendar into a covert communications channel for receiving commands and exfiltrating stolen data. The campaign appears highly targeted, with at least 12 identified victims, primarily Israeli organizations, and only a small subset actively communicating with attacker infrastructure, suggesting a disciplined espionage operation.

Read More

VoidLink: An Emerging Cloud-Focused Linux Malware Framework

Jan 20, 2026 1:03:14 PM / by The Hivemind posted in Threat Bulletin, C2 framework, Linux malware framework, cloud-native malware, Zig programming language, Linux rootkit, adaptive stealth, VoidLink malware, Chinese threat actors, container escape

Verticals Targeted: None confirmed
Regions Targeted: None confirmed
Related Families: None

Executive Summary

VoidLink represents an advanced, modular Linux malware framework developed with apparent Chinese affiliation, emphasizing cloud and container environments for stealthy, persistent access. Designed as a comprehensive post-exploitation tool with adaptive evasion and a plugin-based architecture, it remains in active development with no observed real-world deployments to date.

Read More