# FamousSparrow APT Targets Azerbaijani Oil & Gas Industry via Exchange ProxyShell/ProxyNotShell (Deed RAT, Terndoor, Mofu Loader)

> FamousSparrow, a China-aligned APT overlapping with the Earth Estries ecosystem, ran a three-wave espionage intrusion against an Azerbaijani oil and gas company from December 2025 to February 2026. Initial access was unauthenticated exploitation of an unpatched Microsoft Exchange server via the ProxyShell and ProxyNotShell chains, followed by web shells, an evolved two-stage DLL side-loading technique, and the Deed RAT and Terndoor backdoors delivered via Mofu Loader.

- **Published:** 2026-06-10T00:00:00Z
- **Last reviewed:** 2026-06-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0749
- **ID:** TL-2026-0749
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** GhostEmperor (China)
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2021-34473, CVE-2021-34523, CVE-2021-31207, CVE-2022-41040, CVE-2022-41082

## Description

Bitdefender Labs (Victor Vrabie, Martin Zugec; published 2026-05-13) documented a sustained multi-wave intrusion against an oil and gas company in Azerbaijan, attributed with moderate-to-high confidence to FamousSparrow, a Chinese cyber-espionage group with substantial tooling and infrastructure overlap with the Earth Estries / UAT-9244 ecosystem. The campaign is notable for the actor's repeated return to the same vulnerable Microsoft Exchange entry point across three waves over roughly two months despite multiple remediation attempts.

Initial access occurred on December 25, 2025, when unauthenticated attackers exploited an unpatched Microsoft Exchange server using the ProxyShell chain (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and the ProxyNotShell chain (CVE-2022-41040, CVE-2022-41082). Exploitation manifested as the IIS worker process w3wp.exe writing malicious .aspx web shells (key.aspx, log.aspx, errorFE_.aspx, signout_.aspx) into publicly accessible directories, providing durable remote command execution.

Wave 1 (early January 2026) deployed Deed RAT via a three-component DLL side-loading chain installed under C:\Program Files (x86)\LogMeIn Hamachi\: the legitimate LogMeIn Hamachi binary LMIGuardianSvc.exe (MD5 0554f3b69d39d175dd110d765c11347a) side-loads the malicious LMIGuardianDll.dll, which decrypts the encrypted payload .hamachi.lng. The variant introduces an evolved DLL side-loading method that splits functionality across two exports (Init and ComMain): Init hooks StartServiceCtrlDispatcherW via API patching, and execution stays gated until ComMain is triggered through the host application's natural control flow, defeating sandboxes that do not reproduce full application startup. Payload encryption is AES-128-CBC (16 null-byte IV, key derived from the first 16 file bytes); shellcode is RC4-decrypted; plugins are Deflate-decompressed (upgraded from Snappy); the Deed RAT magic value changed from 0xDEED4554 to 0xFF66ABCD; strings use a custom PRNG-based XOR (state = 3 * (state + ROL1(state, 3))) and configuration uses PRNG-XOR with magic 0x46B78C45. Wave 1 configuration: mutex HJBNDusadnfy3278rnhsdaf, service name 'LogMeIn Hamachi', registry SOFTWARE\Microsoft\LogMeIn Hamachi, injection targets SearchIndexer.exe/taskeng.exe/iexplore.exe/taskhost.exe, C2 virusblocker.it.com:443. Persistence is a Windows service set to auto-start. The actor then pivoted laterally: RDP to a second server using compromised domain administrator credentials, an interactive PowerShell console to stage Deed RAT, and Impacket atexec/smbexec for SMB-based lateral movement to a third machine.

Wave 2 (late January 2026) attempted to deploy the Terndoor backdoor via Mofu Loader using a USOShared side-loading chain: the legitimate deskband_injector64.exe renamed to C:\ProgramData\USOShared\USOShared.exe (MD5 762f787534a891eca8aa9b41330b4108) side-loads malicious winmm.dll, and a kernel driver vmflt.sys was staged as a rootkit attempt (service Type=1, ImagePath \??\C:\ProgramData\USOShared\vmflt.sys). Mofu Loader uses a NOP+CALL self-locating shellcode that uses the return address to find the encrypted payload, a 12-byte header (4-byte seed + two 4-byte size fields), subtract-XOR-add decryption, and LZNT1-compressed PE with stripped MZ/PE headers. Terndoor matches Talos UAT-9244 sample section names, uses RC4 with a hardcoded key, reconstructs strings on the stack via one-byte XOR, injects into msdt.exe, and references artifacts cache.dat, xboxs.sys.

Wave 3 (late February 2026) returned with a modified Deed RAT relocated to C:\Recovery with changed configuration: mutex HJKMNbxzcv9876asdfghj, service name HamachiNet, updated injection targets (SearchIndexer.exe/wininit.exe/dwm.exe/taskhost.exe), and new C2 sentinelonepro.com:443. The campaign reflects expansion of FamousSparrow victimology — historically telecom, government and technology across the US, Asia-Pacific, Middle East and South Africa — into South Caucasus energy infrastructure, consistent with Azerbaijan's increased strategic importance to European energy security after the December 2024 expiry of the Russia-Ukraine gas transit deal and 2026 Strait of Hormuz disruptions.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1505.003 Web Shell
- T1543.003 Windows Service
- T1547.006 Kernel Modules and Extensions
- T1569.002 Service Execution
- T1059.001 PowerShell
- T1574.001 DLL
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1055 Process Injection
- T1014 Rootkit
- T1036.003 Rename Legitimate Utilities
- T1685 Disable or Modify Tools
- T1078.002 Domain Accounts
- T1021.001 Remote Desktop Protocol
- T1021.002 SMB/Windows Admin Shares
- T1071.001 Web Protocols
- T1573.001 Symmetric Cryptography
- T1105 Ingress Tool Transfer
- T1082 System Information Discovery

## Sources

- [FamousSparrow APT Targets Azerbaijani Oil & Gas Industry](https://www.bitdefender.com/en-gb/blog/businessinsights/famoussparrow-apt-targets-azerbaijani-oil-gas-industry)
- [Bitdefender FamousSparrow IOC CSV](https://github.com/bitdefender/malware-ioc/blob/master/2026_05_13-famoussparrow-iocs.csv)
- [Cisco Talos UAT-9244 / Earth Estries Analysis](https://blog.talosintelligence.com/uat-9244/)
- [Trend Micro Earth Estries](https://www.trendmicro.com/en_us/research/24/k/earth-estries.html)
- [ESET FamousSparrow Cyberespionage in the United States](https://www.eset.com/us/about/newsroom/research/cyberespionage-attacks-by-the-china-aligned-famoussparrow-group-in-the-united-states-eset-research-discovers/)
- [Bitdefender ProxyHell Exploit Chains in the Wild](https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-proxyhell-exploit-chains-in-the-wild)
- [JPCERT JSAC2024 Mofu Loader Analysis](https://jsac.jpcert.or.jp/archive/2024/pdf/JSAC2024_1_7_hara_nakajima_kawakami_jp.pdf)
- [PT Security Space Pirates Tools and Connections (Deed RAT)](https://ptsecurity.com/research/pt-esc-threat-intelligence/space-pirates-tools-and-connections/)
- [Dark Reading: China's FamousSparrow APT Nests in South Caucasus Energy Firm](https://www.darkreading.com/cyberattacks-data-breaches/china-famoussparrow-apt-south-caucasus-energy-firm)
- [SecurityAffairs: FamousSparrow targets Azerbaijani energy sector](https://securityaffairs.com/192113/apt/famoussparrow-targets-azerbaijani-energy-sector-in-multi-wave-espionage-campaign.html)
- [SOC Prime: FamousSparrow Hits Azerbaijan's Oil and Gas Sector](https://socprime.com/active-threats/famoussparrow-targets-azerbaijans-oil-and-gas-sector/)
- [Industrial Cyber: Bitdefender uncovers FamousSparrow attacks on Azerbaijan energy sector](https://industrialcyber.co/utilities-energy-power-water-waste/bitdefender-uncovers-famoussparrow-attacks-on-azerbaijan-energy-sector-using-dll-sideloading-deed-rat-malware/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0749