Essential Insights
- A Chinese-linked threat actor, FamousSparrow, targeted an Azerbaijani oil and gas company with multiple waves of malware deployment, exploiting the same vulnerable Microsoft Exchange Server using the ProxyNotShell chain.
- The attackers repeatedly swapped backdoors—Deed RAT and TernDoor—by leveraging DLL side-loading techniques and web shells to maintain persistence and evade defenses.
- The operation demonstrates high persistence, with repeated access attempts, malware evolution, and lateral movement, highlighting a sustained and adaptive cyber espionage campaign.
Threat, Attack Techniques, and Targets
A threat actor linked to China has been attacking an Azerbaijani energy company multiple times. The attacks happened from late December 2025 to late February 2026. The hacker group is called FamousSparrow. They share some tactics with other groups like Earth Estries and Salt Typhoon. Their goal was to install backdoors that help them control the network secretly.
The attackers used the same weak spot in Microsoft Exchange Server to enter the company’s network. They exploited the ProxyNotShell vulnerability to get initial access. Once inside, they tried to keep their presence hidden by deploying web shells and then installing malware. They used techniques like DLL side-loading, which tricks legitimate programs to load malicious code. They also moved laterally within the network to gain more access and keep persistence.
The targets were parts of Azerbaijan’s energy sector, which plays an important role in European energy security. This attack shows the importance of this sector and the risk it faces from cyber threats.
Impact, Security Implications, and Remediation Guidance
The attacks could allow hackers to control and spy on the energy company’s systems. They could steal sensitive information and disrupt operations. Because the same vulnerability was used repeatedly, the threat shows that attackers are persistent. They will keep trying to regain access until the vulnerability is fixed.
The security implications are serious. The attack highlights the need for strong cybersecurity practices. It also shows the importance of patching known vulnerabilities quickly and monitoring for unusual activity.
If you are affected, you should get remediation guidance from the relevant vendor or authority. Since this involves Microsoft Exchange, it is crucial to apply the latest patches for the ProxyNotShell vulnerability. Also, review account access and remove any unauthorized backdoors. Regularly update your incident detection and response procedures to deal with similar threats.
Continue Your Tech Journey
Stay informed on the revolutionary breakthroughs in Quantum Computing research.
Access comprehensive resources on technology by visiting Wikipedia.
ThreatIntel-V1
