HOLLOWGRAPH, FortiSandbox Zero-Day, and the Silence Before the Storm

HOLLOWGRAPH represents the first documented case of an Iranian-nexus actor using Microsoft 365 calendar events as a bidirectional command-and-control channel. Operators create calendar events with encoded instructions in the subject line — using patterns such as Event ID: or Boss{..}ID{..} — dated 2050-05-13, far enough in the future that users never see them in their calendar view. Stolen data is encrypted with RSA + AES-256-GCM and attached to calendar events as File{n}.txt. DNS tunneling via cloudlanecdn[.]com refreshes Entra ID OAuth credentials, maintaining access even after token expiration. The on-disk configuration file masquerades as a legitimate Azure log: logAzure.txt.

Twelve Israeli organisations have been compromised since 3 June 2026. Attribution carries low confidence linkage to Lyceum (an OilRig/APT34 sub-cluster), with moderate confidence the operation is Iranian-nexus based on victimology and infrastructure patterns. Why this matters for your organisation: if your environment runs Microsoft 365, traditional network-based C2 detection is blind to this technique. The traffic is legitimate Graph API calls to Microsoft infrastructure. Only API-level audit logging will detect it.

CVE-2026-25089 is a pre-authentication OS command injection vulnerability in Fortinet FortiSandbox, rated CVSS 9.8. Affected versions span 5.0.0–5.0.5, 4.4.0–4.4.8, all 4.2.x versions, and Cloud/PaaS editions. It was added to the CISA Known Exploited Vulnerabilities catalogue on 16 July 2026 — and we are now at Day 4 post-listing. Pioneer Kitten, an IRGC-affiliated group, has a documented pattern of exploiting Fortinet vulnerabilities within 24–72 hours of KEV listing.

The irony is acute: FortiSandbox is a security tool. Compromising it gives attackers the ability to disable malware analysis, understand what an organisation can and cannot detect, and pivot deeper into the network from a trusted security appliance. Any organisation running a vulnerable version that has not yet patched must treat this as an active emergency — not a scheduled maintenance item.

Three IPs on Tehran-based ASN 213790 ("Limited Network") continue operating as confirmed APT command-and-control infrastructure, with confidence scores of 91–97%:

The co-occurrence of Cactus ransomware and IcedID (a known initial-access-broker tool) on Iranian state infrastructure signals a blurring of state and criminal operations. A "ransomware" incident originating from this infrastructure may actually be state-sponsored espionage using ransomware as cover — or revenue generation funding further operations.

Iran's most destructive hacktivist proxies — Handala and Cyber Av3ngers — have been silent throughout the active retaliation window. Historical patterns show these groups typically launch DDoS, defacement, or wiper attacks within 24–48 hours of kinetic strikes against Iranian targets. We are now past 96 hours of silence during the 8th consecutive strike night.

This is not consistent with a decision not to retaliate. It is consistent with preparation for a larger, coordinated operation. The precedent: after the Soleimani assassination, Iranian cyber retaliation (Pay2Key campaign) lagged kinetic events by approximately 10 days. Cyber Av3ngers' current silence, combined with the expanded ICS attack surface from nine new advisories, creates a particularly high-risk window for OT-targeting operations.

Assessment: this is not cessation. It is preparation.

IP 5.160.228[.]186 on ASN 42337 (Respina Networks, Iran) has been confirmed active with ties to Rampant Kitten — an MOIS-linked group primarily known for domestic dissident surveillance using the TeleSpy mobile implant. During military escalation, MOIS surveillance actors historically pivot from internal dissident monitoring to external battle damage assessment (BDA) collection.

This activation should be monitored for crossover into external espionage operations. Rampant Kitten's existing tradecraft — mobile implant deployment, credential phishing, and covert communication interception — is directly transferable to external intelligence collection targeting diaspora communities, opposition figures, and government personnel with Iranian-origin connections.

Nine simultaneous CISA ICS advisories published on 16 July 2026 affect systems directly relevant to Iranian ICS targeting patterns — particularly Cyber Av3ngers' documented history of rapid post-advisory exploitation:

• Rockwell CompactLogix/ControlLogix/GuardLogix (ICSA-26-197-06) — Denial of service affecting water and energy sectors
• Siemens SICAM 8/A8000 (ICSA-26-197-05) — Multiple DoS vulnerabilities in grid protection systems
• SALTO ProAccess Space — Privilege escalation in physical access control systems
• Rockwell Arena — Arbitrary code execution
• Rockwell FactoryTalk DataMosaix — Script injection
• AutomationDirect, NASA cFS — Additional OT/aerospace system vulnerabilities

The combination of Cyber Av3ngers' anomalous silence and this expanded ICS attack surface is the highest-risk OT scenario since this conflict began. Cyber Av3ngers exploited newly disclosed ICS vulnerabilities within days of advisory publication in previous cycles.