The Door Left Open: FamousSparrow's Three-Wave Intrusion into Azerbaijani Energy Infrastructure- 187
June 7, 2026
ProxyNotShell was publicly disclosed in October 2022. The Exchange server at the center of the FamousSparrow intrusion campaign documented by Bitdefender was still exploitable through at least late February 2026 — more than three years later. The attackers returned through the same vulnerable entry point on three separate occasions, each time with different payloads, each time finding the door open. That structural fact is both the operational finding of the campaign and its most important defensive lesson.
The timing of the intrusion is not incidental to its strategic significance. Azerbaijan has become one of Europe's most important energy suppliers following the collapse of Russian gas transit arrangements at the end of 2024 and the disruption of Strait of Hormuz shipments in early 2026, delivering gas to thirteen countries including Germany and Austria. Against that backdrop, the targeting of an Azerbaijani oil and gas company by a China-aligned actor fits a pattern that has become characteristic of Chinese strategic espionage: following the energy supply chains that matter geopolitically, and moving into regions where Chinese Belt and Road economic leverage is growing as Russian influence contracts. This is the first documented instance of the FamousSparrow cluster — which overlaps with Earth Estries and Salt Typhoon activity — operating against South Caucasus energy infrastructure.
The intrusion began on December 25, 2025, when the attackers exploited the ProxyNotShell vulnerability chain in the victim's Microsoft Exchange Server, dropping web shells into publicly accessible directories over the following days. The initial payload was Deed RAT, a ShadowPad successor used across multiple Chinese espionage groups, delivered through a DLL sideloading technique that stands out for its operational care. Rather than the conventional approach of replacing a legitimate DLL and executing immediately on load, the malicious library split its logic across two export functions — Init and ComMain — creating a two-stage execution gate tied to the host application's natural startup flow. The legitimate LogMeIn Hamachi binary served as the carrier. Only when the application followed its full natural startup path to call a patched Windows API function did the hook redirect control into the loader, which then decrypted and executed the Deed RAT payload from an encrypted file. The design ensures that security sandboxes examining only parts of the execution chain observe no malicious behavior. With persistence established, the attackers moved laterally via RDP using domain administrator credentials and spread further using Impacket-style SMB execution utilities, building redundant footholds across the environment within minutes of the initial lateral movement session.
Nearly a month later, the attackers returned through the same Exchange server and attempted to deploy Terndoor — a backdoor previously observed in attacks against South American telecommunications infrastructure — through a Mofu loader shellcode chain abusing a renamed copy of a legitimate binary. The attempt was blocked before completion, but the artifacts recovered were sufficient to confirm the payload: RC4 implementation with a hardcoded key matching documented Terndoor samples, section names consistent with Cisco Talos reporting on UAT-9244, and an attempt to create a kernel driver service in a non-standard location that legitimate drivers almost never occupy.
At the end of February 2026, the attackers made a third attempt, this time returning to the same LogMeIn Hamachi sideloading chain, but with a modified Deed RAT configuration. The mutex name had changed, the service was renamed, injection targets were updated, and the C2 address had shifted to a domain masquerading as a well-known endpoint security vendor — where the first wave used a domain crafted to resemble a security vendor, the third used the name of one directly. The files had been relocated to a different directory, suggesting awareness that earlier artifacts had been identified. The access path, however, remained unchanged. The Exchange server was still there. The web shells were still viable. The attacker who keeps returning through the same door is an attacker who has correctly assessed that the door has not been properly closed.
Bitdefender's conclusion is unambiguous: organizations in sectors that geopolitical actors consider strategically valuable continue to run unpatched internet-facing services years after vulnerabilities are disclosed. ProxyNotShell and ProxyShell have been publicly documented since 2021 and 2022 respectively. The campaign this report describes was still exploiting them in early 2026. Patching internet-facing services is not a sophisticated defensive measure. It remains, however, evidently insufficient as a universal practice — and the gap between disclosure and remediation is where operations like this one live.
