FamousSparrow APT Targets Azerbaijani Oil & Gas Industry via Exchange ProxyShell/ProxyNotShell (Deed RAT, Terndoor, Mofu Loader)
FamousSparrow APT Targets Azerbaijani Oil & Gas Industry via (TL-2026-0749), also tracked as FamousSparrow Azerbaijan Oil & Gas Campaign, is a critical-severity advanced persistent threat campaign scored CVSS 9.8, first published 2026-06-10. It is attributed to GhostEmperor (China) with medium confidence, affects Microsoft Exchange Server, references 5 CVEs (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207), maps to 20 MITRE ATT&CK techniques (T1014, T1021.001, T1021.002), and is covered by 9 detection rules and 29 indicators of compromise.
Key facts for TL-2026-0749
- Threat ID
- TL-2026-0749
- Also known as
- FamousSparrow Azerbaijan Oil & Gas Campaign, Earth Estries South Caucasus Energy Intrusion
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- APT
- First published
- 2026-06-10
- Last reviewed
- 2026-06-10
- Attribution
- GhostEmperor
- Attribution confidence
- MEDIUM
- Nation-state nexus
- China
- Motivation
- ESPIONAGE
- Target sectors
- energy, oil and gas, critical infrastructure
- Target regions
- Azerbaijan, South Caucasus, Europe
- Detection rules
- 9
- Indicators of compromise
- 29
Malware and tooling in FamousSparrow APT Targets Azerbaijani Oil & Gas Industry via
Malware and tooling: Mofu Loader, SNAPPYBEE, Terndoor, Impacket - S0357
FamousSparrow, a China-aligned APT overlapping with the Earth Estries ecosystem, ran a three-wave espionage intrusion against an Azerbaijani oil and gas company from December 2025 to February 2026. Initial access was unauthenticated exploitation of an unpatched Microsoft Exchange server via the ProxyShell and ProxyNotShell chains, followed by web shells, an evolved two-stage DLL side-loading technique, and the Deed RAT and Terndoor backdoors delivered via Mofu Loader.
How FamousSparrow APT Targets Azerbaijani Oil & Gas Industry via works
Bitdefender Labs (Victor Vrabie, Martin Zugec; published 2026-05-13) documented a sustained multi-wave intrusion against an oil and gas company in Azerbaijan, attributed with moderate-to-high confidence to FamousSparrow, a Chinese cyber-espionage group with substantial tooling and infrastructure overlap with the Earth Estries / UAT-9244 ecosystem. The campaign is notable for the actor's repeated return to the same vulnerable Microsoft Exchange entry point across three waves over roughly two months despite multiple remediation attempts.
Initial access occurred on December 25, 2025, when unauthenticated attackers exploited an unpatched Microsoft Exchange server using the ProxyShell chain (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and the ProxyNotShell chain (CVE-2022-41040, CVE-2022-41082). Exploitation manifested as the IIS worker process w3wp.exe writing malicious .aspx web shells (key.aspx, log.aspx, errorFE_.aspx, signout_.aspx) into publicly accessible directories, providing durable remote command execution.
Wave 1 (early January 2026) deployed Deed RAT via a three-component DLL side-loading chain installed under C:\Program Files (x86)\LogMeIn Hamachi\: the legitimate LogMeIn Hamachi binary LMIGuardianSvc.exe (MD5 0554f3b69d39d175dd110d765c11347a) side-loads the malicious LMIGuardianDll.dll, which decrypts the encrypted payload .hamachi.lng. The variant introduces an evolved DLL side-loading method that splits functionality across two exports (Init and ComMain): Init hooks StartServiceCtrlDispatcherW via API patching, and execution stays gated until ComMain is triggered through the host application's natural control flow, defeating sandboxes that do not reproduce full application startup. Payload encryption is AES-128-CBC (16 null-byte IV, key derived from the first 16 file bytes); shellcode is RC4-decrypted; plugins are Deflate-decompressed (upgraded from Snappy); the Deed RAT magic value changed from 0xDEED4554 to 0xFF66ABCD; strings use a custom PRNG-based XOR (state = 3 * (state + ROL1(state, 3))) and configuration uses PRNG-XOR with magic 0x46B78C45. Wave 1 configuration: mutex HJBNDusadnfy3278rnhsdaf, service name 'LogMeIn Hamachi', registry SOFTWARE\Microsoft\LogMeIn Hamachi, injection targets SearchIndexer.exe/taskeng.exe/iexplore.exe/taskhost.exe, C2 virusblocker.it.com:443. Persistence is a Windows service set to auto-start. The actor then pivoted laterally: RDP to a second server using compromised domain administrator credentials, an interactive PowerShell console to stage Deed RAT, and Impacket atexec/smbexec for SMB-based lateral movement to a third machine.
Wave 2 (late January 2026) attempted to deploy the Terndoor backdoor via Mofu Loader using a USOShared side-loading chain: the legitimate deskband_injector64.exe renamed to C:\ProgramData\USOShared\USOShared.exe (MD5 762f787534a891eca8aa9b41330b4108) side-loads malicious winmm.dll, and a kernel driver vmflt.sys was staged as a rootkit attempt (service Type=1, ImagePath \??\C:\ProgramData\USOShared\vmflt.sys). Mofu Loader uses a NOP+CALL self-locating shellcode that uses the return address to find the encrypted payload, a 12-byte header (4-byte seed + two 4-byte size fields), subtract-XOR-add decryption, and LZNT1-compressed PE with stripped MZ/PE headers. Terndoor matches Talos UAT-9244 sample section names, uses RC4 with a hardcoded key, reconstructs strings on the stack via one-byte XOR, injects into msdt.exe, and references artifacts cache.dat, xboxs.sys.
Wave 3 (late February 2026) returned with a modified Deed RAT relocated to C:\Recovery with changed configuration: mutex HJKMNbxzcv9876asdfghj, service name HamachiNet, updated injection targets (SearchIndexer.exe/wininit.exe/dwm.exe/taskhost.exe), and new C2 sentinelonepro.com:443. The campaign reflects expansion of FamousSparrow victimology — historically telecom, government and technology across the US, Asia-Pacific, Middle East and South Africa — into South Caucasus energy infrastructure, consistent with Azerbaijan's increased strategic importance to European energy security after the December 2024 expiry of the Russia-Ukraine gas transit deal and 2026 Strait of Hormuz disruptions.
MITRE ATT&CK techniques used in TL-2026-0749
Defense Evasion
T1014 Rootkit; T1027 Obfuscated Files or Information; T1036.003 Rename Legitimate Utilities; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information
Lateral Movement
T1021.001 Remote Desktop Protocol; T1021.002 SMB/Windows Admin Shares
Execution
T1059.001 PowerShell; T1569.002 Service Execution
Command and Control
T1071.001 Web Protocols; T1105 Ingress Tool Transfer; T1573.001 Symmetric Cryptography
stealth
T1078.002 Domain Accounts; T1574.001 DLL
Discovery
T1082 System Information Discovery
Initial Access
T1190 Exploit Public-Facing Application
Persistence
T1505.003 Web Shell; T1543.003 Windows Service; T1547.006 Kernel Modules and Extensions
defense-impairment
Affected products and versions in FamousSparrow APT Targets Azerbaijani Oil & Gas Industry via
- Microsoft — Exchange Server
Vulnerable versions: 2013; 2016; 2019 (unpatched, pre-ProxyShell/ProxyNotShell updates)
Fixed in: 2016/2019 with ProxyShell + Nov 2022 ProxyNotShell updates
Remediation for FamousSparrow APT Targets Azerbaijani Oil & Gas Industry via
Patches
- Microsoft Exchange ProxyShell cumulative updates (KB5001779 and later)
- Microsoft Exchange ProxyNotShell November 2022 security updates
Immediate actions
- Patch all internet-facing Microsoft Exchange servers against ProxyShell (CVE-2021-34473/34523/31207) and ProxyNotShell (CVE-2022-41040/41082)
- Hunt for and remove malicious .aspx web shells (key.aspx, log.aspx, errorFE_.aspx, signout_.aspx) and audit w3wp.exe file writes
- Block C2 domains virusblocker.it.com and sentinelonepro.com at perimeter and DNS
- Rotate all domain administrator credentials immediately after remediation
Workarounds
- Restrict Exchange external access and enable Exchange Emergency Mitigation Service
- Block kernel driver service creation from non-standard paths (e.g., C:\ProgramData\USOShared\vmflt.sys)
Longer-term hardening
- Deploy runtime behavioral EDR; signature-only detection is insufficient for fileless DLL side-loading
- Monitor for unsigned binaries patching system API entry points (e.g., StartServiceCtrlDispatcherW hooking)
- Alert on domain-admin RDP sessions outside maintenance windows and on Impacket atexec/smbexec usage
- Enforce network segmentation between Exchange/DMZ and OT/energy infrastructure
CVEs associated with FamousSparrow APT Targets Azerbaijani Oil & Gas Industry via
CVE-2021-34473, CVE-2021-34523, CVE-2021-31207, CVE-2022-41040, CVE-2022-41082
Weaknesses (CWE) in FamousSparrow APT Targets Azerbaijani Oil & Gas Industry via
CWE-918, CWE-502, CWE-78, CWE-427
Timeline of FamousSparrow APT Targets Azerbaijani Oil & Gas Industry via
- ProxyShell exploit chain (CVE-2021-34473/34523/31207) publicly documented and weaponized in the wild.
- ProxyNotShell (CVE-2022-41040/41082) disclosed as exploited Microsoft Exchange zero-days.
- FamousSparrow exploits an unpatched Exchange server via ProxyShell/ProxyNotShell; w3wp.exe writes web shells (key.aspx, log.aspx, errorFE_.aspx, signout_.aspx).
- Additional web shell deployment attempts on the compromised Exchange server through Dec 29, 2025.
- Wave 1: Deed RAT deployed via LogMeIn Hamachi DLL side-loading; lateral movement via RDP (domain admin), PowerShell staging, and Impacket atexec/smbexec; C2 virusblocker.it.com:443.
- Wave 2: Terndoor backdoor delivered via Mofu Loader through USOShared side-loading; kernel rootkit driver vmflt.sys staging attempt.
- Wave 3: Modified Deed RAT relocated to C:\Recovery with new mutex/service (HamachiNet) and new C2 sentinelonepro.com:443.
- Bitdefender Labs publishes the FamousSparrow Azerbaijan oil & gas campaign analysis with IOCs.
Sources cited for FamousSparrow APT Targets Azerbaijani Oil & Gas Industry via
- FamousSparrow APT Targets Azerbaijani Oil & Gas Industry
- Bitdefender FamousSparrow IOC CSV
- Cisco Talos UAT-9244 / Earth Estries Analysis
- Trend Micro Earth Estries
- ESET FamousSparrow Cyberespionage in the United States
- Bitdefender ProxyHell Exploit Chains in the Wild
- JPCERT JSAC2024 Mofu Loader Analysis
- PT Security Space Pirates Tools and Connections (Deed RAT)
- Dark Reading: China's FamousSparrow APT Nests in South Caucasus Energy Firm
- SecurityAffairs: FamousSparrow targets Azerbaijani energy sector
- SOC Prime: FamousSparrow Hits Azerbaijan's Oil and Gas Sector
- Industrial Cyber: Bitdefender uncovers FamousSparrow attacks on Azerbaijan energy sector
Threats related to FamousSparrow APT Targets Azerbaijani Oil & Gas Industry via
- FamousSparrow APT Multi-Wave Intrusion at Azerbaijani Oil & Gas Company — Evolved Two-Stage DLL Sideloading Delivers Deed RAT (0xFF66ABCD) and Terndoor via Mofu Loader
- FamousSparrow APT Targets Azerbaijani Oil & Gas Sector via ProxyShell/ProxyNotShell Exchange Exploitation
- UAT-8099 (China) BadIIS Malware Campaign Targeting IIS Servers for SEO Fraud
Detection coverage for TL-2026-0749
As of 2026-06-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0749 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.