FamousSparrow APT Targets Azerbaijani Oil & Gas Sector via ProxyShell/ProxyNotShell Exchange Exploitation
FamousSparrow APT Targets Azerbaijani Oil & Gas Sector via (TL-2026-2122) is a critical-severity advanced persistent threat campaign scored CVSS 9.8, first published 2026-08-23. It is attributed to Salt Typhoon - G1045 (China) with medium confidence, affects Microsoft Exchange Server, references 5 CVEs (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207), maps to 16 MITRE ATT&CK techniques (T1014, T1021.001, T1021.002), and is covered by 9 detection rules and 22 indicators of compromise.
Key facts for TL-2026-2122
- Threat ID
- TL-2026-2122
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- APT
- First published
- 2026-08-23
- Last reviewed
- 2026-08-23
- Attribution
- Salt Typhoon - G1045
- Attribution confidence
- MEDIUM
- Nation-state nexus
- China
- Motivation
- ESPIONAGE
- Target sectors
- oil and gas, energy, critical infrastructure, telecoms, government administration, technology
- Target regions
- South Caucasus, azerbaijan, united states of america, Asia-Pacific, Middle East, south africa, 005 - South America
- Detection rules
- 9
- Indicators of compromise
- 22
Malware and tooling in FamousSparrow APT Targets Azerbaijani Oil & Gas Sector via
Malware and tooling: SNAPPYBEE, Terndoor, Impacket - S0357
Bitdefender documents a multi-wave FamousSparrow (Earth Estries-linked, suspected Chinese-affiliated) intrusion against an Azerbaijani oil and gas company, beginning December 25, 2025 with a web shell dropped via unpatched Microsoft Exchange (ProxyShell/ProxyNotShell) and continuing through late February 2026 with repeated Deed RAT and Terndoor backdoor deployments, lateral movement using compromised domain admin credentials, and evolved DLL sideloading/anti-analysis techniques.
How FamousSparrow APT Targets Azerbaijani Oil & Gas Sector via works
Bitdefender's Business Insights team traced a three-wave intrusion against an unnamed Azerbaijani oil and gas company that began on December 25, 2025, when an attacker exploited the ProxyNotShell chain (CVE-2022-41040/CVE-2022-41082) against an unpatched, internet-facing Microsoft Exchange server, with the initial exploitation attempt visible as a malicious ASPX web shell drop attempt from the w3wp.exe worker process. Over the following days the actor returned repeatedly, dropping additional web shells (key.aspx, log.aspx, errorFE_.aspx, signout_.aspx) on the same server. The underlying vulnerable Exchange install was also exposed to the earlier ProxyShell chain (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207), consistent with a server that had never been fully patched against either 2021 or 2022 Exchange RCE chains.
From the web shell foothold, the actor staged Deed RAT (also tracked as SNAPPYBEE), a modular Chinese-APT backdoor, via DLL side-loading disguised as a LogMeIn Hamachi installation: a legitimate-looking LMIGuardianSvc.exe side-loads a malicious lmiguardiandll.dll, which decrypts an AES-128-CBC payload (.hamachi.lng) and beacons to virusblocker[.]it[.]com over port 443. The loader implements a novel two-export sideloading gate — splitting execution across Init and ComMain exports so that the malicious code only runs after the legitimate host application naturally calls a patched StartServiceCtrlDispatcherW, evading sandboxes that only observe partial process startup. Deed RAT's plugin architecture (module IDs for Startup/Config/Plugin/Network/NetSocket/NetProxy/Install/Inject/Orchestrator) and layered decryption (AES-128-CBC to unwrap the payload, a custom PRNG-XOR for plugins, RC4 for the next-stage orchestrator, and LZNT1/Deflate for final decompression) matches the toolkit publicly documented for FamousSparrow/Earth Estries by ESET, Trend Micro, Microsoft, and PT Security (Space Pirates), but with an updated magic value (0xDEED4554 to 0xFF66ABCD in the final wave) and a compression-algorithm swap from Snappy to Deflate — evidence of active tool development rather than reuse of a static toolkit.
In late January 2026 the actor attempted to deploy Terndoor (TernDoor), a CrowDoor-family backdoor also linked to the China-nexus cluster UAT-9244 by Cisco Talos, via a Mofu shellcode loader (documented by JPCERT) sideloaded through a renamed deskband_injector64.exe (USOShared.exe) and a malicious winmm.dll under C:\ProgramData\USOShared. This wave also attempted to install a kernel driver (vmflt.sys) via a Windows service registry entry, and injected into msdt.exe; the payload was staged as cache.dat and used a hardcoded RC4 key with strings reconstructed on the stack at runtime. Section-name overlap and RC4 implementation similarities tie this sample to the Terndoor family reported against South American telecom providers.
During the campaign the actor obtained and used compromised domain administrator credentials to move laterally: an interactive RDP session to a second host was followed by PowerShell execution and manual staging of Deed RAT components, and Impacket's atexec and smbexec utilities were used for SMB/Windows Admin Shares-based lateral movement across additional internal hosts. A final wave in late February 2026 redeployed Deed RAT with a modified configuration (new mutex, service name "HamachiNet", relocated to C:\Recovery\) and a new C2 domain, sentinelonepro[.]com, again over port 443 — the third distinct return to the same vulnerable Exchange server despite intervening remediation attempts, indicating either incomplete patching/credential rotation or a second undiscovered foothold.
Bitdefender attributes the intrusion with moderate-to-high confidence to the FamousSparrow/Earth Estries ecosystem based on the combined toolset (Exchange exploitation, web shells, Deed RAT, Mofu-based Terndoor staging), shared mbedTLS-derived cryptography between this and prior Deed RAT loaders, and an execution model (StartServiceCtrlDispatcherW hooking) identical to a Trend Micro-documented sample (MD5 505b55c2b68e32acb5ad13588e1491a5). Note that attribution in this space is contested: while Microsoft and Trend Micro cluster FamousSparrow, Earth Estries, GhostEmperor, and Salt Typhoon together, ESET researchers maintain FamousSparrow and Earth Estries/GhostEmperor are distinct, if TTP-overlapping, China-nexus operators. This is the first documented FamousSparrow-ecosystem activity against the energy sector in the South Caucasus, extending known victimology beyond the group's historical focus on telecommunications, government, and technology targets in the Americas, Asia-Pacific, Middle East, and South Africa. Bitdefender frames the targeting against the backdrop of Azerbaijan's growing role in European energy security following the expiry of the Russia-Ukraine gas transit agreement (end of 2024) and Strait of Hormuz disruptions in early 2026, during which Azerbaijan expanded gas exports to 13 European countries with 56% cumulative export growth since 2021.
MITRE ATT&CK techniques used in TL-2026-2122
Defense Evasion
T1014 Rootkit; T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1574.001 DLL
Lateral Movement
T1021.001 Remote Desktop Protocol; T1021.002 SMB/Windows Admin Shares
Execution
T1059.001 PowerShell; T1569.002 Service Execution
Command and Control
defense-impairment
T1112 Modify Registry; T1685 Disable or Modify Tools
Initial Access
T1190 Exploit Public-Facing Application
Persistence
Affected products and versions in FamousSparrow APT Targets Azerbaijani Oil & Gas Sector via
- Microsoft — Exchange Server
Vulnerable versions: Exchange Server 2013 before CU23 15.00.1497.015; Exchange Server 2016 before CU19 15.01.2176.012 / CU20 15.01.2242.008; Exchange Server 2019 before CU8 15.02.0792.013 / CU9 15.02.0858.010
Fixed in: Exchange Server 2013 CU23 with post-15.00.1497.015 security update; Exchange Server 2016 CU19/CU20 with corresponding security update; Exchange Server 2019 CU8/CU9 with corresponding security update, including the November 2022 ProxyNotShell update
Remediation for FamousSparrow APT Targets Azerbaijani Oil & Gas Sector via
Patches
- Exchange Server 2013 CU23 security update (post 15.00.1497.015)
- Exchange Server 2016 CU19/CU20 security updates (post 15.01.2176.012 / 15.01.2242.008)
- Exchange Server 2019 CU8/CU9 security updates (post 15.02.0792.013 / 15.02.0858.010)
- November 2022 cumulative update addressing ProxyNotShell (CVE-2022-41040/CVE-2022-41082)
Immediate actions
- Apply Microsoft Exchange Server cumulative updates and security patches addressing CVE-2021-34473, CVE-2021-34523, CVE-2021-31207, CVE-2022-41040, and CVE-2022-41082
- Hunt for and remove ASPX web shells (key.aspx, log.aspx, errorFE_.aspx, signout_.aspx) on internet-facing Exchange servers
- Reset domain administrator and all privileged credentials used on or from the compromised Exchange server and any hosts it authenticated to
- Block C2 domains virusblocker.it.com and sentinelonepro.com at the network perimeter and DNS resolver
- Isolate and re-image hosts showing the LogMeIn Hamachi/USOShared service masquerade or the identified file, mutex, and registry artifacts
Workarounds
- Interim URL Rewrite mitigation rule blocking known ProxyShell/ProxyNotShell exploitation URL patterns pending patch deployment
Longer-term hardening
- Deploy EDR with behavioral detection for DLL side-loading and API hooking of StartServiceCtrlDispatcherW
- Enforce network segmentation isolating Exchange servers from domain controllers and OT-adjacent IT systems
- Implement tiered administration so domain admin credentials are never usable from or cached on internet-facing servers
- Monitor for Impacket-based lateral movement (atexec/smbexec) over SMB/Windows Admin Shares
CVEs associated with FamousSparrow APT Targets Azerbaijani Oil & Gas Sector via
CVE-2021-34473, CVE-2021-34523, CVE-2021-31207, CVE-2022-41040, CVE-2022-41082
Weaknesses (CWE) in FamousSparrow APT Targets Azerbaijani Oil & Gas Sector via
CWE-918
Timeline of FamousSparrow APT Targets Azerbaijani Oil & Gas Sector via
- FamousSparrow exploits the ProxyNotShell chain (CVE-2022-41040/CVE-2022-41082) against an unpatched Microsoft Exchange server; a malicious ASPX web shell drop attempt is observed from the w3wp.exe worker process.
- Additional ASPX web shells (key.aspx, log.aspx, errorFE_.aspx, signout_.aspx) are dropped on the compromised Exchange server over the following days.
- Deed RAT Wave 1 deployed via DLL side-loading disguised as LogMeIn Hamachi (LMIGuardianSvc.exe + lmiguardiandll.dll); AES-128-CBC payload .hamachi.lng decrypted and malware beacons to virusblocker[.]it[.]com:443.
- Attempted Terndoor deployment via a Mofu shellcode loader, sideloaded through renamed USOShared.exe/winmm.dll under C:\ProgramData\USOShared, including an attempted vmflt.sys kernel driver installation and injection into msdt.exe.
- Compromised domain administrator credentials used for an interactive RDP session to a second host, followed by PowerShell execution and manual staging of Deed RAT components.
- Impacket atexec and smbexec utilities used for SMB/Windows Admin Shares-based lateral movement across additional internal hosts using the compromised domain admin credentials.
- Deed RAT Wave 3 redeployed with a modified configuration (new mutex, magic value 0xFF66ABCD, Deflate compression, service name "HamachiNet", relocated to C:\Recovery\), beaconing to sentinelonepro[.]com:443 — the third distinct return to the same vulnerable Exchange server.
Sources cited for FamousSparrow APT Targets Azerbaijani Oil & Gas Sector via
- FamousSparrow APT Targets Azerbaijani Oil & Gas Industry
- Urgent: Protect Against Active Exploitation of ProxyShell Vulnerabilities
- CVE-2021-34473 Detail
- Analyzing attacks using the Exchange vulnerabilities CVE-2022-41040 and CVE-2022-41082
- UAT-9244 targets South American telecommunication providers with three new malware implants
- Game of Emperor: Unveiling Long Term Earth Estries Cyber Intrusions
- You will always remember this as the day you finally caught FamousSparrow
- DeedRAT Backdoor Enhanced by Chinese APTs with Advanced Capabilities
- China-Linked Hackers Use TernDoor, PeerTime, BruteEntry in South American Telecom Attacks
Threats related to FamousSparrow APT Targets Azerbaijani Oil & Gas Sector via
- FamousSparrow APT Targets Azerbaijani Oil & Gas Industry via Exchange ProxyShell/ProxyNotShell (Deed RAT, Terndoor, Mofu Loader)
- FamousSparrow APT Multi-Wave Intrusion at Azerbaijani Oil & Gas Company — Evolved Two-Stage DLL Sideloading Delivers Deed RAT (0xFF66ABCD) and Terndoor via Mofu Loader
- UAT-8099 (China) BadIIS Malware Campaign Targeting IIS Servers for SEO Fraud
Detection coverage for TL-2026-2122
As of 2026-08-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2122 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.