FamousSparrow APT Targets Azerbaijani Oil & Gas Industry via Exchange ProxyShell/ProxyNotShell (Deed RAT, Terndoor, Mofu Loader) — Threadlinqs Intelligence
As of 2026-06-10, FamousSparrow APT Targets Azerbaijani Oil & Gas Industry via Exchange ProxyShell/ProxyNotShell (Deed RAT, Terndoor, Mofu Loader) is a critical-severity apt threat attributed to GhostEmperor (China), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 29 indicators of compromise.
Threat ID: TL-2026-0749 · Severity: CRITICAL · CVSS: 9.8 · Status: ACTIVE · Category: APT
Attribution: GhostEmperor · China · ESPIONAGE
FamousSparrow, a China-aligned APT overlapping with the Earth Estries ecosystem, ran a three-wave espionage intrusion against an Azerbaijani oil and gas company from December 2025 to February 2026.
Bitdefender Labs (Victor Vrabie, Martin Zugec; published 2026-05-13) documented a sustained multi-wave intrusion against an oil and gas company in Azerbaijan, attributed with moderate-to-high confidence to FamousSparrow, a Chinese cyber-espionage group with substantial tooling and infrastructure overlap with the Earth Estries / UAT-9244 ecosystem. The campaign is notable for the actor's repeated return to the same vulnerable Microsoft Exchange entry point across three waves over roughly two months despite multiple remediation attempts.
Initial access occurred on December 25, 2025, when unauthenticated attackers exploited an unpatched Microsoft Exchange server using the ProxyShell chain (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and the ProxyNotShell chain (CVE-2022-41040, CVE-2022-41082). Exploitation manifested as the IIS worker process w3wp.exe writing malicious .aspx web shells (key.aspx, log.aspx, errorFE_.aspx, signout_.aspx) into publicly accessible directories, providing durable remote command execution.
Wave 1 (early January 2026) deployed Deed RAT via a three-component DLL side-loading chain installed under C:\Program Files (x86)\LogMeIn Hamachi\: the legitimate LogMeIn Hamachi binary LMIGuardianSvc.exe (MD5 0554f3b69d39d175dd110d765c11347a) side-loads the malicious LMIGuardianDll.dll, which decrypts the encrypted payload .hamachi.lng. The variant introduces an evolved DLL side-loading method that splits functionality across two exports (Init and ComMain): Init hooks StartServiceCtrlDispatcherW via API patching, and execution stays gated until ComMain is triggered through the host application's natural control flow, defeating sandboxes that do not reproduce full application startup. Payload encryption is AES-128-CBC (16 null-byte IV, key derived from the first 16 file bytes); shellcode is RC4-decrypted; plugins are Deflate-decompressed (upgraded from Snappy); the Deed RAT magic value changed from 0xDEED4554 to 0xFF66ABCD; strings use a custom PRNG-based XOR (state = 3 * (state + ROL1(state, 3))) and configuration uses PRNG-XOR with magic 0x46B78C45. Wave 1 configuration: mutex HJBNDusadnfy3278rnhsdaf, service name 'LogMeIn Hamachi', registry SOFTWARE\Microsoft\LogMeIn Hamachi, injection targets SearchIndexer.exe/taskeng.exe/iexplore.exe/taskhost.exe, C2 virusblocker.it.com:443. Persistence is a Windows service set to auto-start. The actor then pivoted laterally: RDP to a second server using compromised domain administrator credentials, an interactive PowerShell console to stage Deed RAT, and Impacket atexec/smbexec for SMB-based lateral movement to a third machine.
Wave 2 (late January 2026) attempted to deploy the Terndoor backdoor via Mofu Loader using a USOShared side-loading chain: the legitimate deskband_injector64.exe renamed to C:\ProgramData\USOShared\USOShared.exe (MD5 762f787534a891eca8aa9b41330b4108) side-loads malicious winmm.dll, and a kernel driver vmflt.sys was staged as a rootkit attempt (service Type=1, ImagePath \??\C:\ProgramData\USOShared\vmflt.sys). Mofu Loader uses a NOP+CALL self-locating shellcode that uses the return address to find the encrypted payload, a 12-byte header (4-byte seed + two 4-byte size fields), subtract-XOR-add decryption, and LZNT1-compressed PE with stripped MZ/PE headers. Terndoor matches Talos UAT-9244 sample section names, uses RC4 with a hardcoded key, reconstructs strings on the stack via one-byte XOR, injects into msdt.exe, and references artifacts cache.dat, xboxs.sys.
Wave 3 (late February 2026) returned with a modified Deed RAT relocated to C:\Recovery with changed configuration: mutex HJKMNbxzcv9876asdfghj, service name HamachiNet, updated injection targets (SearchIndexer.exe/wininit.exe/dwm.exe/taskhost.exe), and new C2 sentinelonepro.com:443. The campaign reflects expansion of FamousSparrow victimology — historically telecom, government and technology across the US, Asia-Pacific, Middle East and South Africa — into South Caucasus energy infrastructure,
Weaknesses (CWE)
CWE-918, CWE-502, CWE-78, CWE-427
Target sectors: energy, oil and gas, critical infrastructure
Target regions: Azerbaijan, South Caucasus, Europe
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 29 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
APT, CRITICAL, threat intelligence, cybersecurity, CVE-2021-34473, CVE-2021-34523, CVE-2021-31207, CVE-2022-41040, CVE-2022-41082, T1190, T1505.003, T1543.003, T1547.006, T1569.002, T1059.001, T1574.002, T1140, T1027, T1055