Adversary Intelligence — 2026-05-15

FamousSparrow Targets Azerbaijani Energy Sector in Multi-Wave Espionage Campaign

BLUFFamousSparrow's threefold return to a single unpatched Exchange server signals that Azerbaijan's expanding role as a European gas supplier has made its energy sector a durable Chinese collection priority.

Bitdefender attributed with moderate-to-high confidence a three-wave intrusion against an Azerbaijani oil and gas company to FamousSparrow, a Chinese-linked actor overlapping with the Earth Estries threat ecosystem. Attackers exploited ProxyNotShell on an unpatched Microsoft Exchange server beginning December 25, 2025 and returned to the same entry point twice more through late February 2026, despite remediation attempts. Deed RAT appeared in waves one and three through an evolved two-stage DLL sideloading technique abusing a legitimate LogMeIn Hamachi binary; a wave-two Terndoor attempt via Mofu loader was blocked before installation completed. Bitdefender reported this as the first documented FamousSparrow/Earth Estries intrusion against energy infrastructure in the South Caucasus.

Analysis
FamousSparrow's three returns to the same Exchange server, per a single Bitdefender investigation, reflect sustained collection against a target prioritized during Azerbaijan's sharpest expansion as a European gas supplier. The DLL sideloading refinement, withholding payload until host startup completes, targets sandbox analysis, not generic toolchain maintenance. Modified Deed RAT configuration and C2 impersonating security vendors confirm active detection-risk management throughout. The persistence fits commercially-driven collection against a Belt and Road-exposed company as readily as strategically-directed energy espionage. ProxyNotShell remaining viable as the sole entry point through late February 2026, more than three years after disclosure, is a patching failure FamousSparrow exposed but did not cause.

2 sources

FamousSparrow targets Azerbaijani energy sector in multi-wave espionage campaign - Security Affairs
FamousSparrow APT Targets Azerbaijani Oil and Gas Industry - Bitdefender