FamousSparrow APT Multi-Wave Intrusion at Azerbaijani Oil & Gas Company — Evolved Two-Stage DLL Sideloading Delivers Deed RAT (0xFF66ABCD) and Terndoor via Mofu Loader
FamousSparrow APT Multi-Wave Intrusion at Azerbaijani Oil & (TL-2026-0509), also tracked as FamousSparrow Azerbaijan Intrusion, is a critical-severity advanced persistent threat campaign scored CVSS 9.8, first published 2026-05-13. It is attributed to GhostEmperor (China) with medium confidence, affects Microsoft Exchange Server, references 2 CVEs (CVE-2022-41040, CVE-2022-41082), maps to 33 MITRE ATT&CK techniques (T1003, T1014, T1016), and is covered by 9 detection rules and 32 indicators of compromise.
Key facts for TL-2026-0509
- Threat ID
- TL-2026-0509
- Also known as
- FamousSparrow Azerbaijan Intrusion, Operation Hamachi Sparrow (Threadlinqs internal)
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- APT
- First published
- 2026-05-13
- Last reviewed
- 2026-05-13
- Attribution
- GhostEmperor
- Attribution confidence
- MEDIUM
- Nation-state nexus
- China
- Motivation
- ESPIONAGE
- Target sectors
- oil-and-gas, energy, critical-infrastructure
- Target regions
- South Caucasus, Azerbaijan, Europe (downstream energy supply)
- Detection rules
- 9
- Indicators of compromise
- 32
Malware and tooling in FamousSparrow APT Multi-Wave Intrusion at Azerbaijani Oil &
Malware and tooling: SNAPPYBEE, Terndoor, Deed RAT custom HTTPS C2, Impacket atexec / smbexec, Mofu loader
Bitdefender Labs uncovered a sustained, three-wave intrusion against an Azerbaijani oil and gas company from late December 2025 through late February 2026, attributed with moderate-to-high confidence to the China-nexus FamousSparrow APT (overlapping the Earth Estries/UAT-9244 ecosystem). The operation re-exploits the same unpatched Microsoft Exchange server (ProxyNotShell-class CVE-2022-41040/CVE-2022-41082) across all three waves and introduces an evolved two-stage DLL sideloading trigger that overrides two specific exports (Init and ComMain) to gate the Deed RAT loader through the host application's natural control flow. Deed RAT itself has been refactored — magic value rotated from 0xDEED4554 to 0xFF66ABCD, plugin compression migrated from Snappy to Deflate, configuration magic changed to 0x46B78C45, and invocation IDs shifted by 0x100 — while Wave 2 attempted to install the Terndoor backdoor with a vmflt.sys kernel driver via the Mofu loader. Attackers re-entered the network three times despite remediation, performed RDP lateral movement with stolen domain administrator credentials, and used Impacket-style atexec/smbexec for SMB-based spread. The campaign marks FamousSparrow's first publicly reported expansion into the South Caucasus energy sector and aligns with Azerbaijan's elevated role in European energy security after the 2024 Russia-Ukraine gas transit expiration and 2026 Strait of Hormuz disruptions.
How FamousSparrow APT Multi-Wave Intrusion at Azerbaijani Oil & works
Bitdefender Labs (Victor Vrabie, published May 13, 2026) tracked a multi-wave cyberespionage operation against an unnamed Azerbaijani oil and gas company that ran from approximately December 25, 2025 through late February 2026. The operation is attributed with moderate-to-high confidence to FamousSparrow, a Chinese APT first documented by ESET in 2021 and shown to substantially overlap with the Earth Estries toolset and tradecraft documented by Trend Micro and the Cisco Talos UAT-9244 cluster.
Initial Access (Wave 1, December 2025). The attackers exploited a publicly accessible, unpatched Microsoft Exchange server. Telemetry shows w3wp.exe (the IIS worker process) executing under the MSExchangePowerShellAppPool context — a signature of the ProxyNotShell exploit chain (CVE-2022-41040 SSRF + CVE-2022-41082 deserialization RCE). Web shell files key.aspx, log.aspx, errorFE_.aspx, and signout_.aspx were written to publicly accessible directories on December 25, 26, and 29, 2025. Each remediation attempt was followed by re-exploitation of the same entry point.
Evolved Two-Stage DLL Sideloading. After webshell access, the attackers staged three files into C:\TEMP\: the legitimate, signed LogMeIn Hamachi binary LMIGuardianSvc.exe (MD5 0554f3b69d39d175dd110d765c11347a), a malicious lmiguardiandll.dll that the host loads via DLL search-order hijacking, and an encrypted payload container .hamachi.lng. The innovation in this campaign is the loader DLL's use of two specific exported functions to split execution into a two-stage trigger: * Init — invoked first; modifies StartServiceCtrlDispatcherW's API entry point by relaxing memory protections, writing a hook, and preserving the original bytes for later restoration. Init then exits without running the payload, allowing LMIGuardianSvc.exe to continue along its normal control flow. * ComMain — invoked later during the legitimate startup sequence; when the host application naturally calls StartServiceCtrlDispatcherW, the hook redirects execution into the malicious loader, which restores the original API bytes and proceeds to decrypt and execute the .hamachi.lng payload. The loader also exports CryptProtectDataNoUI and CryptUnprotectDataNoUI containing mbedTLS-derived cryptographic code, although these appear unreachable in the execution chain and serve as obfuscation/code-reuse cover. Because the payload only detonates if the host follows the exact expected call sequence, sandbox environments that execute exports out of context fail to trigger the chain.
Deed RAT (Waves 1 and 3). The .hamachi.lng container is AES-128-CBC encrypted with a 16-byte null IV; the key is the first 16 bytes of the file. Plaintext is shellcode plus the Deed RAT orchestrator, which is further decoded with RC4 using a key embedded at a hardcoded offset. Payload bodies are LZNT1-compressed via RtlDecompressBuffer. Compared to prior public reporting, this variant has been substantially refactored: * Module magic value rotated from 0xDEED4554 to 0xFF66ABCD; configuration magic now 0x46B78C45. * Plugin compression migrated from Snappy to Deflate for improved compatibility. * Plugin invocation IDs offset by 0x100; entry-point dispatcher values offset by 0x10 (vs. prior 0x1/0x2/0x4). * Plugin encryption uses a custom PRNG-based XOR with a 4-byte big-endian seed and 4-byte size field; strings use a stateful XOR algorithm (state = 3 * (state + ROL1(state, 3))) terminated by a byte equal to the current state. * APIs resolved at runtime using ELF hashing (VirtualAlloc/VirtualFree/VirtualProtect/RtlDecompressBuffer hashes computed) to hide imports. Module IDs remain consistent across variants: 0x20 Orchestrator, 0x30 Startup, 0x40 Config, 0x50 Plugin, 0x60 Network, 0x70 NetSocket, 0x90 NetProxy, 0xA0 Install, 0xB0 Inject. Persistence is achieved by creating a Windows service named LogMeIn Hamachi (Wave 1) or HamachiNet (Wave 3). Code injection in Wave 1 targets SearchIndexer.exe, taskeng.exe, iexplore.exe, and taskhost.exe; Wave 3 swaps in wininit.exe and dwm.exe alongside SearchIndexer.exe and taskhost.exe. The Wave 1 C2 was virusblocker[.]it[.]com:443 (HTTPS) protected by an RSA-2048 public key; Wave 3 rotates to sentinelonepro[.]com:443 with a refreshed RSA key. Wave 1 mutex HJBNDusadnfy3278rnhsdaf is replaced by HJKMNbxzcv9876asdfghj in Wave 3, and components are relocated to C:\Recovery\.
Terndoor (Wave 2, late January 2026). Approximately a month after the initial intrusion, attackers returned through the same Exchange entry point and deployed a renamed deskband_injector64.exe as C:\ProgramData\USOShared\USOShared.exe (MD5 762f787534a891eca8aa9b41330b4108), abusing it to sideload a malicious winmm.dll. The DLL contained a Mofu shellcode loader whose prologue is a NOP + CALL pair that uses the return address to locate an encrypted payload appended to the shellcode. A 12-byte header (4-byte seed + two 4-byte size fields) precedes the encrypted body, which is decoded with a one-round subtract-XOR-add transformation, decompressed with LZNT1, and reconstituted into a Terndoor PE with stripped MZ/PE headers. Recovered configuration strings include msdt.exe (injection target), cache.dat (payload container), vmflt.sys (kernel driver dropped to C:\ProgramData\USOShared\), and xboxs.sys (function unknown). Registry artifacts HKLM\SYSTEM\ControlSet001\Services\vmflt\Type=1 and ImagePath=\??\C:\ProgramData\USOShared\vmflt.sys evidence the rootkit-class kernel driver service. The defensive product blocked execution before full installation; the first 4 KB of the loader was recovered from memory. The RC4 key-scheduling fingerprint matches the Terndoor sample documented by Cisco Talos in the UAT-9244 reporting. During this wave the host contacted ipinfo[.]io to enumerate its public IP.
Lateral Movement. In Wave 1 the attackers leveraged stolen domain administrator credentials to perform interactive RDP into a second host, where they spawned a PowerShell console and manually staged the malware files. A third system was infected via Impacket-style atexec/smbexec utilities executed from a Linux origin, indicating an established attacker workstation outside the Windows fleet.
Operational Pattern and Strategic Significance. The attackers' willingness to return three times to the same Exchange server, swap backdoor families (Deed RAT → Terndoor → Deed RAT), and refresh tradecraft mid-operation evidences sustained espionage intent and operational discipline. FamousSparrow has historically targeted telecoms, government, and technology sectors across the United States, Asia-Pacific, the Middle East, and South Africa; this campaign is the first publicly reported expansion into South Caucasus energy. The targeting aligns with Azerbaijan's growing role in European energy security following the December 2024 expiration of Russia's Ukraine gas transit agreement, the early-2026 Qatar LNG suspensions and Strait of Hormuz disruptions, and Azerbaijan's reported 56% cumulative growth in gas exports to 13 European countries since 2021.
Defender Implications. Detection must hunt for: (a) ProxyNotShell webshell patterns in MSExchangePowerShellAppPool child processes; (b) LMIGuardianSvc.exe or deskband_injector64.exe running from C:\TEMP, C:\ProgramData\USOShared, or C:\Recovery rather than their canonical install paths; (c) services named LogMeIn Hamachi or HamachiNet on hosts that have never had LogMeIn installed; (d) StartServiceCtrlDispatcherW hooking patterns inside non-system processes; (e) creation of HKLM\SYSTEM\ControlSet001\Services\vmflt with kernel driver Type=1; (f) outbound TLS to virusblocker[.]it[.]com or sentinelonepro[.]com; (g) Impacket atexec/smbexec service-creation footprints (random 8-character service names invoking cmd.exe with redirected output).
MITRE ATT&CK techniques used in TL-2026-0509
Credential Access
stealth
Discovery
T1016 System Network Configuration Discovery; T1057 Process Discovery; T1082 System Information Discovery
Lateral Movement
T1021.001 Remote Services: Remote Desktop Protocol; T1021.002 Remote Services: SMB/Windows Admin Shares
Defense Evasion
T1027 Obfuscated Files or Information; T1027.013 Obfuscated Files or Information: Encrypted/Encoded File; T1036.005 Match Legitimate Resource Name or Location; T1055.001 Process Injection: Dynamic-link Library Injection; T1070.004 Indicator Removal: File Deletion; T1140 Deobfuscate/Decode Files or Information; T1620 Reflective Code Loading
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1047 Windows Management Instrumentation; T1059.001 Command and Scripting Interpreter: PowerShell; T1569.002 System Services: Service Execution
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1102 Web Service; T1105 Ingress Tool Transfer; T1573.001 Encrypted Channel: Symmetric Cryptography; T1573.002 Encrypted Channel: Asymmetric Cryptography
Initial Access
T1078.002 Valid Accounts: Domain Accounts; T1190 Exploit Public-Facing Application
defense-impairment
Persistence
T1505.003 Server Software Component: Web Shell; T1543.003 Create or Modify System Process: Windows Service
Resource Development
T1583.001 Acquire Infrastructure: Domains; T1587.001 Develop Capabilities: Malware; T1588.002 Obtain Capabilities: Tool
Reconnaissance
Affected products and versions in FamousSparrow APT Multi-Wave Intrusion at Azerbaijani Oil &
- Microsoft — Exchange Server
Vulnerable versions: 2013 CU23; 2016 CU22; 2016 CU23; 2019 CU11; 2019 CU12
Fixed in: 2016 CU23 + Nov 2022 SU (KB5019758); 2019 CU12 + Nov 2022 SU (KB5019758) - LogMeIn (GoTo) — LogMeIn Hamachi (LMIGuardianSvc.exe)
Vulnerable versions: any version when binary is placed outside default install path
Fixed in: N/A — abuse pattern, not a product vulnerability
Remediation for FamousSparrow APT Multi-Wave Intrusion at Azerbaijani Oil &
Patches
- Microsoft Exchange Server November 2022 SU resolves CVE-2022-41040 and CVE-2022-41082 (KB5019758).
- Apply March 2024 and subsequent cumulative updates to Exchange Server 2019 to remediate downstream variants and harden the PowerShell endpoint.
- Patch any unpatched ProxyShell-class CVEs (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) for completeness.
Immediate actions
- Apply Microsoft Exchange security updates for CVE-2022-41040 and CVE-2022-41082 (ProxyNotShell) and confirm CU/SU levels against the current MSRC guidance; isolate any Exchange server still running 2019/2016 builds older than the Nov 2022 SU.
- Block egress to virusblocker[.]it[.]com and sentinelonepro[.]com at the perimeter and add both domains to TLS inspection/SNI blocklists; alert on any historical resolution.
- Hunt for LMIGuardianSvc.exe outside C:\Program Files (x86)\LogMeIn Hamachi\, deskband_injector64.exe / USOShared.exe in C:\ProgramData\USOShared, and any .hamachi.lng, cache.dat, vmflt.sys, or xboxs.sys file in non-default paths.
- Search for the Windows services named LogMeIn Hamachi or HamachiNet on hosts that have never had LogMeIn software installed and remove them.
- Query the registry for HKLM\SYSTEM\CurrentControlSet\Services\vmflt and remove the service and driver image; verify no kernel driver was successfully loaded.
- Block the SHA1/MD5 hashes 0554f3b69d39d175dd110d765c11347a and 762f787534a891eca8aa9b41330b4108 in EDR and gateway AV.
- Force a password reset and Kerberos krbtgt double-rotation for any domain administrator credential that may have been exposed; review RDP sessions originating from non-jump-host workstations.
Workarounds
- If patching is delayed: apply Microsoft's URL Rewrite mitigation for ProxyNotShell and disable remote PowerShell for non-administrators (Set-User -Identity <user> -RemotePowerShellEnabled $false).
- Block the /powershell virtual directory from the internet via WAF or perimeter ACL.
- Disable LogMeIn Hamachi-style legitimate binaries from auto-elevation; remove unused Microsoft Store sideload binaries (deskband_injector64.exe) from build images.
Longer-term hardening
- Deploy EDR with behavioral detection capable of catching API hooks against StartServiceCtrlDispatcherW and reflective/section-mapped DLL loads from C:\TEMP, C:\ProgramData, and C:\Recovery.
- Move Exchange to Exchange Online or apply a network-front policy that requires authenticated, MFA-gated access before any /autodiscover or /powershell endpoint is reachable from the internet.
- Enable Windows Defender Application Control (WDAC) or AppLocker policies that block execution of LogMeIn-signed binaries from non-Program Files paths.
- Tier domain administrator accounts (Tier 0) so they cannot authenticate interactively to workstation/server tiers via RDP; require Privileged Access Workstations.
- Roll out attack surface reduction rule 'Block credential stealing from LSASS' and audit for Impacket service-name patterns (8-char random + cmd.exe /Q /c).
- Deploy network segmentation so that the Exchange DMZ cannot reach internal file shares, ERP, or OT/ICS network segments hosting SCADA assets.
- Subscribe to FamousSparrow/Earth Estries threat intelligence feeds and replay all detection rules across 365 days of telemetry to surface latent compromise.
CVEs associated with FamousSparrow APT Multi-Wave Intrusion at Azerbaijani Oil &
Weaknesses (CWE) in FamousSparrow APT Multi-Wave Intrusion at Azerbaijani Oil &
CWE-918, CWE-502, CWE-427, CWE-78
Timeline of FamousSparrow APT Multi-Wave Intrusion at Azerbaijani Oil &
- Wave 1 begins. w3wp.exe under MSExchangePowerShellAppPool attempts to write web shells to publicly accessible directories on the victim's Microsoft Exchange server — first observed activity, consistent with ProxyNotShell (CVE-2022-41040 + CVE-2022-41082) exploitation.
- Additional .aspx web shell deployment attempts (key.aspx, log.aspx, errorFE_.aspx, signout_.aspx) executed via w3wp.exe; remediation actions are followed by repeated re-exploitation.
- Third round of web shell deployment attempts on the same Exchange server, confirming the entry point remains unpatched.
- Wave 1 payload staging: LMIGuardianSvc.exe, lmiguardiandll.dll, and the encrypted .hamachi.lng container are written to C:\TEMP\. The LogMeIn Hamachi service is registered, the two-stage Init/ComMain DLL sideload triggers, and Deed RAT (magic 0xFF66ABCD) beacons to virusblocker[.]it[.]com:443.
- Attackers pivot via RDP using stolen domain administrator credentials to a second internal host, spawn a PowerShell console, and manually stage the Deed RAT components.
- Impacket-style atexec/smbexec utilities (executed from a Linux-origin attacker workstation) are used to spread the infection to a third host without an interactive logon.
- Wave 2: attackers re-enter through the same Exchange entry point and deploy deskband_injector64.exe (renamed to USOShared.exe) sideloading malicious winmm.dll under C:\ProgramData\USOShared\. The Mofu shellcode loader stages Terndoor and attempts to register the vmflt.sys kernel driver service. The host contacts ipinfo[.]io for IP discovery.
- The defensive product blocks the Wave 2 execution before full installation; the first 4 KB of the Mofu loader is recovered from memory, enabling Bitdefender's reverse engineering of the loader and Terndoor's RC4 key-scheduling fingerprint (matching Cisco Talos UAT-9244 reporting).
- Wave 3: Deed RAT is redeployed with an identical execution chain but rotated configuration — new C2 sentinelonepro[.]com:443, new mutex HJKMNbxzcv9876asdfghj, new service name HamachiNet, modified injection targets (wininit.exe, dwm.exe added), refreshed RSA public key, and component relocation to C:\Recovery\.
- Last observed Wave 3 activity in Bitdefender telemetry; the campaign window closes at approximately late February 2026.
- Bitdefender Labs publishes the full technical analysis (Victor Vrabie), disclosing the two-stage DLL sideloading innovation, the Deed RAT 0xFF66ABCD refactor, and the FamousSparrow expansion into the South Caucasus energy sector.
- As of 2026-05-29, this remains ACTIVE: Bitdefender disclosed it only 16 days prior (May 13), the PRC-MSS FamousSparrow/Earth Estries/Salt Typhoon actor is undisrupted (FBI confirmed ongoing in Feb 2026), and the ProxyNotShell CVEs (CVE-2022-41040/41082, both in CISA KEV) saw a ~178% surge in exploitation in April 2026.
Sources cited for FamousSparrow APT Multi-Wave Intrusion at Azerbaijani Oil &
- FamousSparrow APT Targets Azerbaijani Oil and Gas Industry — Victor Vrabie, Bitdefender Business Insights (US)
- FamousSparrow APT Targets Azerbaijani Oil and Gas Industry — Bitdefender Business Insights (UK)
- FamousSparrow: A suspicious hotel guest — ESET WeLiveSecurity (original FamousSparrow attribution)
- MITRE ATT&CK Group G0134 — FamousSparrow
- NVD — CVE-2022-41040 (Microsoft Exchange Server-Side Request Forgery)
- NVD — CVE-2022-41082 (Microsoft Exchange Remote Code Execution)
- Microsoft Security Update Guide — November 2022 Exchange Server SU (ProxyNotShell)
- MITRE ATT&CK Technique T1574.002 — DLL Side-Loading
- MITRE ATT&CK Technique T1505.003 — Web Shell
Threats related to FamousSparrow APT Multi-Wave Intrusion at Azerbaijani Oil &
- FamousSparrow APT Targets Azerbaijani Oil & Gas Industry via Exchange ProxyShell/ProxyNotShell (Deed RAT, Terndoor, Mofu Loader)
- FamousSparrow APT Targets Azerbaijani Oil & Gas Sector via ProxyShell/ProxyNotShell Exchange Exploitation
- GopherWhisper — China-Aligned APT Targeting Mongolian Government with Go-Based Burrow Malware Toolkit (LaxGopher, RatGopher, BoxOfFriends, SSLORDoor)
Detection coverage for TL-2026-0509
As of 2026-05-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0509 across Splunk SPL, Microsoft KQL and Sigma, covering 32 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.