# FamousSparrow APT Targets Azerbaijani Oil & Gas Sector via ProxyShell/ProxyNotShell Exchange Exploitation

> Bitdefender documents a multi-wave FamousSparrow (Earth Estries-linked, suspected Chinese-affiliated) intrusion against an Azerbaijani oil and gas company, beginning December 25, 2025 with a web shell dropped via unpatched Microsoft Exchange (ProxyShell/ProxyNotShell) and continuing through late February 2026 with repeated Deed RAT and Terndoor backdoor deployments, lateral movement using compromised domain admin credentials, and evolved DLL sideloading/anti-analysis techniques.

- **Published:** 2026-08-23T00:00:00Z
- **Last reviewed:** 2026-08-23T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2122
- **ID:** TL-2026-2122
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** Salt Typhoon - G1045 (China)
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2021-34473, CVE-2021-34523, CVE-2021-31207, CVE-2022-41040, CVE-2022-41082

## Description

Bitdefender's Business Insights team traced a three-wave intrusion against an unnamed Azerbaijani oil and gas company that began on December 25, 2025, when an attacker exploited the ProxyNotShell chain (CVE-2022-41040/CVE-2022-41082) against an unpatched, internet-facing Microsoft Exchange server, with the initial exploitation attempt visible as a malicious ASPX web shell drop attempt from the w3wp.exe worker process. Over the following days the actor returned repeatedly, dropping additional web shells (key.aspx, log.aspx, errorFE_.aspx, signout_.aspx) on the same server. The underlying vulnerable Exchange install was also exposed to the earlier ProxyShell chain (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207), consistent with a server that had never been fully patched against either 2021 or 2022 Exchange RCE chains.

From the web shell foothold, the actor staged Deed RAT (also tracked as SNAPPYBEE), a modular Chinese-APT backdoor, via DLL side-loading disguised as a LogMeIn Hamachi installation: a legitimate-looking LMIGuardianSvc.exe side-loads a malicious lmiguardiandll.dll, which decrypts an AES-128-CBC payload (.hamachi.lng) and beacons to virusblocker[.]it[.]com over port 443. The loader implements a novel two-export sideloading gate — splitting execution across Init and ComMain exports so that the malicious code only runs after the legitimate host application naturally calls a patched StartServiceCtrlDispatcherW, evading sandboxes that only observe partial process startup. Deed RAT's plugin architecture (module IDs for Startup/Config/Plugin/Network/NetSocket/NetProxy/Install/Inject/Orchestrator) and layered decryption (AES-128-CBC to unwrap the payload, a custom PRNG-XOR for plugins, RC4 for the next-stage orchestrator, and LZNT1/Deflate for final decompression) matches the toolkit publicly documented for FamousSparrow/Earth Estries by ESET, Trend Micro, Microsoft, and PT Security (Space Pirates), but with an updated magic value (0xDEED4554 to 0xFF66ABCD in the final wave) and a compression-algorithm swap from Snappy to Deflate — evidence of active tool development rather than reuse of a static toolkit.

In late January 2026 the actor attempted to deploy Terndoor (TernDoor), a CrowDoor-family backdoor also linked to the China-nexus cluster UAT-9244 by Cisco Talos, via a Mofu shellcode loader (documented by JPCERT) sideloaded through a renamed deskband_injector64.exe (USOShared.exe) and a malicious winmm.dll under C:\ProgramData\USOShared. This wave also attempted to install a kernel driver (vmflt.sys) via a Windows service registry entry, and injected into msdt.exe; the payload was staged as cache.dat and used a hardcoded RC4 key with strings reconstructed on the stack at runtime. Section-name overlap and RC4 implementation similarities tie this sample to the Terndoor family reported against South American telecom providers.

During the campaign the actor obtained and used compromised domain administrator credentials to move laterally: an interactive RDP session to a second host was followed by PowerShell execution and manual staging of Deed RAT components, and Impacket's atexec and smbexec utilities were used for SMB/Windows Admin Shares-based lateral movement across additional internal hosts. A final wave in late February 2026 redeployed Deed RAT with a modified configuration (new mutex, service name "HamachiNet", relocated to C:\Recovery\) and a new C2 domain, sentinelonepro[.]com, again over port 443 — the third distinct return to the same vulnerable Exchange server despite intervening remediation attempts, indicating either incomplete patching/credential rotation or a second undiscovered foothold.

Bitdefender attributes the intrusion with moderate-to-high confidence to the FamousSparrow/Earth Estries ecosystem based on the combined toolset (Exchange exploitation, web shells, Deed RAT, Mofu-based Terndoor staging), shared mbedTLS-derived cryptography between this and prior Deed RAT loaders, and an execution model (StartServiceCtrlDispatcherW hooking) identical to a Trend Micro-documented sample (MD5 505b55c2b68e32acb5ad13588e1491a5). Note that attribution in this space is contested: while Microsoft and Trend Micro cluster FamousSparrow, Earth Estries, GhostEmperor, and Salt Typhoon together, ESET researchers maintain FamousSparrow and Earth Estries/GhostEmperor are distinct, if TTP-overlapping, China-nexus operators. This is the first documented FamousSparrow-ecosystem activity against the energy sector in the South Caucasus, extending known victimology beyond the group's historical focus on telecommunications, government, and technology targets in the Americas, Asia-Pacific, Middle East, and South Africa. Bitdefender frames the targeting against the backdrop of Azerbaijan's growing role in European energy security following the expiry of the Russia-Ukraine gas transit agreement (end of 2024) and Strait of Hormuz disruptions in early 2026, during which Azerbaijan expanded gas exports to 13 European countries with 56% cumulative export growth since 2021.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1505.003 Web Shell
- T1543.003 Windows Service
- T1059.001 PowerShell
- T1569.002 Service Execution
- T1574.001 DLL
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1685 Disable or Modify Tools
- T1014 Rootkit
- T1055 Process Injection
- T1112 Modify Registry
- T1036 Masquerading
- T1021.001 Remote Desktop Protocol
- T1021.002 SMB/Windows Admin Shares
- T1071.001 Web Protocols

## Sources

- [FamousSparrow APT Targets Azerbaijani Oil & Gas Industry](https://www.bitdefender.com/en-us/blog/businessinsights/famoussparrow-apt-targets-azerbaijani-oil-gas-industry)
- [Urgent: Protect Against Active Exploitation of ProxyShell Vulnerabilities](https://www.cisa.gov/news-events/alerts/2021/08/21/urgent-protect-against-active-exploitation-proxyshell-vulnerabilities)
- [CVE-2021-34473 Detail](https://nvd.nist.gov/vuln/detail/CVE-2021-34473)
- [Analyzing attacks using the Exchange vulnerabilities CVE-2022-41040 and CVE-2022-41082](https://www.microsoft.com/en-us/security/blog/2022/09/30/analyzing-attacks-using-the-exchange-vulnerabilities-cve-2022-41040-and-cve-2022-41082/)
- [UAT-9244 targets South American telecommunication providers with three new malware implants](https://blog.talosintelligence.com/uat-9244/)
- [Game of Emperor: Unveiling Long Term Earth Estries Cyber Intrusions](https://www.trendmicro.com/en_us/research/24/k/earth-estries.html)
- [You will always remember this as the day you finally caught FamousSparrow](https://www.welivesecurity.com/en/eset-research/you-will-always-remember-this-as-the-day-you-finally-caught-famoussparrow/)
- [DeedRAT Backdoor Enhanced by Chinese APTs with Advanced Capabilities](https://lab52.io/blog/deedrat-backdoor-enhanced-by-chinese-apts-with-advanced-capabilities/)
- [China-Linked Hackers Use TernDoor, PeerTime, BruteEntry in South American Telecom Attacks](https://thehackernews.com/2026/03/china-linked-hackers-use-terndoor.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2122