Full Report
New research from Bitdefender detailed targeting an Azerbaijani oil and gas company in a multi-wave cyberespionage campaign that... The post Bitdefender uncovers FamousSparrow attacks on Azerbaijan energy sector using DLL sideloading, Deed RAT malware appeared first on Industrial Cyber.
Analysis Summary
# Threat Actor: FamousSparrow
## Attribution & Identity
* **Actor Name:** FamousSparrow
* **Origin:** China-linked APT (Advanced Persistent Threat) group.
* **Known Associations:** Overlaps with the **Earth Estries** threat ecosystem.
* **Confidence Level:** Bitdefender attributes this activity with moderate-to-high confidence.
## Activity Summary
The reported campaign was a multi-wave cyberespionage operation running from **late December 2025 through February 2026**. The operation focused on a prominent oil and gas company in Azerbaijan, characterized by strategic persistence where attackers repeatedly exploited the same entry point despite remediation attempts.
## Tactics, Techniques & Procedures
* **Exploitation of Edge Services:** Persistent exploitation of vulnerable Microsoft Exchange servers as the primary entry point.
* **Advanced DLL Sideloading:** Evolved technique that overrides two specific exported functions within a malicious library. This creates a two-stage trigger that gates execution through the host application’s natural control flow to evade sandbox analysis.
* **Defense Evasion:** Malware remains dormant until a specific sequence of internal host application calls is completed.
* **Operational Persistence:** Repeated re-entry and rotation of malware families (three separate waves) to maintain access.
* **Data Compression:** Shifted from Snappy to Deflate compression for plugin decompression within their toolchain.
* **Credential Theft:** Likelihood of credential harvesting to maintain access after initial vulnerability patching.
## Targeting
* **Sectors:** Energy (Oil & Gas), plus historical targeting of Hospitality, Telecom, Government, and Technology.
* **Geography:** Recently expanded to the **South Caucasus (Azerbaijan)**. Historically active in the U.S., Asia-Pacific, Middle East, and South Africa.
* **Victims:** An Azerbaijani oil and gas company (unnamed).
## Tools & Infrastructure
* **Deed RAT:** A signature remote access trojan; the campaign used updated variants with modified magic values and a two-stage loader.
* **Terndoor:** A secondary backdoor family used in conjunction with Deed RAT.
* **Entry Point:** Microsoft Exchange Server.
* **C2/Infrastructure:** (Article mentions rotation of families and updated toolchains but does not list specific defanged IPs/domains).
## Implications
* **Geopolitical Strategy:** The campaign represents an expansion of Chinese cyber activity into the South Caucasus, a region of heightening strategic importance to European energy security following disruptions in the Strait of Hormuz and the expiration of Russia-Ukraine gas agreements.
* **Threat Evolution:** The move from soft targets (hospitality) to critical energy infrastructure indicates a shift toward high-stakes strategic espionage.
* **Persistent Threat:** The actor’s ability to re-exploit the same environment multiple times highlights a "persistent pursuit" model where standard remediation (simple patching) is insufficient without rotation of credentials and thorough eviction.
## Mitigations
* **Vulnerability Management:** Urgent patching and hardening of Internet-facing assets, specifically Microsoft Exchange servers.
* **Credential Hygiene:** Broad rotation of administrative and service account credentials following any suspected breach, as the actor demonstrates high success in re-entry.
* **Advanced Endpoint Monitoring:** Implement EDR/XDR solutions capable of detecting DLL sideloading by monitoring the hijacking of legitimate application control flows.
* **Sandboxing Enhancements:** Utilize sandboxes that can simulate extended application interaction to bypass "dormancy" triggers used by Deed RAT.
* **Network Segmentation:** Isolate critical infrastructure and OT-related business networks from common entry points like mail servers.