FamousSparrow APT Multi-Wave Intrusion at Azerbaijani Oil & Gas Company — Evolved Two-Stage DLL Sideloading Delivers Deed RAT (0xFF66ABCD) and Terndoor via Mofu Loader — Threadlinqs Intelligence
As of 2026-05-30, FamousSparrow APT Multi-Wave Intrusion at Azerbaijani Oil & Gas Company — Evolved Two-Stage DLL Sideloading Delivers Deed RAT (0xFF66ABCD) and Terndoor via Mofu Loader is a critical-severity apt threat attributed to GhostEmperor (China), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 32 indicators of compromise.
Threat ID: TL-2026-0509 · Severity: CRITICAL · CVSS: 9.8 · Status: ACTIVE · Category: APT
Attribution: GhostEmperor · China · ESPIONAGE
Bitdefender Labs uncovered a sustained, three-wave intrusion against an Azerbaijani oil and gas company from late December 2025 through late February 2026, attributed with moderate-to-high confidence
Bitdefender Labs (Victor Vrabie, published May 13, 2026) tracked a multi-wave cyberespionage operation against an unnamed Azerbaijani oil and gas company that ran from approximately December 25, 2025 through late February 2026. The operation is attributed with moderate-to-high confidence to FamousSparrow, a Chinese APT first documented by ESET in 2021 and shown to substantially overlap with the Earth Estries toolset and tradecraft documented by Trend Micro and the Cisco Talos UAT-9244 cluster.
Initial Access (Wave 1, December 2025). The attackers exploited a publicly accessible, unpatched Microsoft Exchange server. Telemetry shows w3wp.exe (the IIS worker process) executing under the MSExchangePowerShellAppPool context — a signature of the ProxyNotShell exploit chain (CVE-2022-41040 SSRF + CVE-2022-41082 deserialization RCE). Web shell files key.aspx, log.aspx, errorFE_.aspx, and signout_.aspx were written to publicly accessible directories on December 25, 26, and 29, 2025. Each remediation attempt was followed by re-exploitation of the same entry point.
Evolved Two-Stage DLL Sideloading. After webshell access, the attackers staged three files into C:\TEMP\: the legitimate, signed LogMeIn Hamachi binary LMIGuardianSvc.exe (MD5 0554f3b69d39d175dd110d765c11347a), a malicious lmiguardiandll.dll that the host loads via DLL search-order hijacking, and an encrypted payload container .hamachi.lng. The innovation in this campaign is the loader DLL's use of two specific exported functions to split execution into a two-stage trigger:
* Init — invoked first; modifies StartServiceCtrlDispatcherW's API entry point by relaxing memory protections, writing a hook, and preserving the original bytes for later restoration. Init then exits without running the payload, allowing LMIGuardianSvc.exe to continue along its normal control flow.
* ComMain — invoked later during the legitimate startup sequence; when the host application naturally calls StartServiceCtrlDispatcherW, the hook redirects execution into the malicious loader, which restores the original API bytes and proceeds to decrypt and execute the .hamachi.lng payload.
The loader also exports CryptProtectDataNoUI and CryptUnprotectDataNoUI containing mbedTLS-derived cryptographic code, although these appear unreachable in the execution chain and serve as obfuscation/code-reuse cover. Because the payload only detonates if the host follows the exact expected call sequence, sandbox environments that execute exports out of context fail to trigger the chain.
Deed RAT (Waves 1 and 3). The .hamachi.lng container is AES-128-CBC encrypted with a 16-byte null IV; the key is the first 16 bytes of the file. Plaintext is shellcode plus the Deed RAT orchestrator, which is further decoded with RC4 using a key embedded at a hardcoded offset. Payload bodies are LZNT1-compressed via RtlDecompressBuffer. Compared to prior public reporting, this variant has been substantially refactored:
* Module magic value rotated from 0xDEED4554 to 0xFF66ABCD; configuration magic now 0x46B78C45.
* Plugin compression migrated from Snappy to Deflate for improved compatibility.
* Plugin invocation IDs offset by 0x100; entry-point dispatcher values offset by 0x10 (vs. prior 0x1/0x2/0x4).
* Plugin encryption uses a custom PRNG-based XOR with a 4-byte big-endian seed and 4-byte size field; strings use a stateful XOR algorithm (state = 3 * (state + ROL1(state, 3))) terminated by a byte equal to the current state.
* APIs resolved at runtime using ELF hashing (VirtualAlloc/VirtualFree/VirtualProtect/RtlDecompressBuffer hashes computed) to hide imports.
Module IDs remain consistent across variants: 0x20 Orchestrator, 0x30 Startup, 0x40 Config, 0x50 Plugin, 0x60 Network, 0x70 NetSocket, 0x90 NetProxy, 0xA0 Install, 0xB0 Inject. Persistence is achieved by creating a Windows service named LogMeIn Hamachi (Wave 1) or HamachiNet (Wave 3). Code injection in Wave 1 targets SearchIndexer.exe, taskeng.exe, iexplore.exe, and t
Weaknesses (CWE)
CWE-918, CWE-502, CWE-427, CWE-78
Target sectors: oil-and-gas, energy, critical-infrastructure
Target regions: South Caucasus, Azerbaijan, Europe (downstream energy supply)
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 32 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
APT, CRITICAL, threat intelligence, cybersecurity, CVE-2022-41040, CVE-2022-41082, T1595, T1583.001, T1588.002, T1587.001, T1190, T1078.002, T1059.001, T1569.002, T1047, T1505.003