Bitdefender Links FamousSparrow to Multi-Wave Exchange Intrusion in Azerbaijan
Summary
Bitdefender attributed a multi-wave intrusion targeting an Azerbaijani oil and gas firm to FamousSparrow with moderate-to-high confidence. The activity reportedly reused an Exchange entry point and involved ProxyNotShell, Deed RAT, and TernDoor.
Key points
- Bitdefender attributed the activity to FamousSparrow (UAT-9244) with moderate-to-high confidence; the victim was not named.
- The intrusion reportedly ran from late December 2025 to late February 2026 and repeatedly targeted the same Microsoft Exchange Server entry point despite remediation attempts.
- ProxyNotShell was assessed as the initial-access method.
- Separate waves involved Deed RAT, an attempted TernDoor deployment that was unsuccessful, and a later modified Deed RAT.
- Attackers attempted to establish persistence with web shells and used lateral movement to extend access.
- A reported DLL side-loading technique used a legitimate LogMeIn Hamachi binary and a rogue DLL to launch Deed RAT.
- The modified Deed RAT artifact reportedly used sentinelonepro[.]com for command-and-control.
Article Details
- Attack Vectors
- The attackers reportedly exploited the ProxyNotShell chain through the same vulnerable Microsoft Exchange Server entry point across multiple waves, despite remediation attempts.
- Web shells were attempted to establish a persistent foothold.
- A legitimate LogMeIn Hamachi binary was used to load a rogue DLL and launch Deed RAT through an evolved DLL side-loading technique.
- The attackers conducted lateral movement within the compromised network.
- Mofu Loader was used in an unsuccessful attempt to deploy TernDoor through DLL side-loading.
- Defensive Notes
- Bitdefender said the original vulnerability should be patched, compromised credentials rotated, and the attacker’s ability to regain access fully disrupted.
MITRE ATT&CK
T1190 · Exploit Public-Facing ApplicationThe attackers reportedly exploited the ProxyNotShell chain against a vulnerable Microsoft Exchange Server entry point for initial access.T1505.003 · Web ShellThe attackers attempted to deploy web shells to establish a persistent foothold.T1574.002 · DLL Side-LoadingA rogue DLL was loaded using the legitimate LogMeIn Hamachi binary to execute Deed RAT; DLL side-loading was also attempted to deploy TernDoor.
Threat Actors
Malware
Deed RATThe campaign used changing payloads including Deed RAT and TernDoor, alongside web shells, lateral movement, and refined DLL side-loading to maintain persistent access.Mofu Loaderwith the adversary attempting to unsuccessfully employ DLL side-loading to drop TernDoor by means of Mofu Loader, a shellcode loader previously attributed to GroundPeony.ShadowPadof two distinct backdoors across three separate waves: Deed RAT (aka Snappybee), a successor of ShadowPad that’s used by multiple China-nexus espionage groups, and TernDoor, which was recently discovered inSNAPPYBEEpaves the way for the deployment of two distinct backdoors across three separate waves: Deed RAT (aka Snappybee), a successor of ShadowPad that’s used by multiple China-nexus espionage groups, and TernDoor, which wasTernDoorThe campaign used changing payloads including Deed RAT and TernDoor, alongside web shells, lateral movement, and refined DLL side-loading to maintain persistent access.
Vendors
LogMeIn, Inc.and ultimately deploy Deed RAT using an evolved DLL side-loading technique that leverages the legitimate LogMeIn Hamachi binary to load and launch a rogue DLL that’s responsible for executing the main payload.MicrosoftBitdefender linked a multi-wave intrusion against an Azerbaijani oil and gas company to FamousSparrow, a China-nexus threat actor, with repeated exploitation of the same Microsoft Exchange Server entry point.
Products
LogMeIn Hamachiultimately deploy Deed RAT using an evolved DLL side-loading technique that leverages the legitimate LogMeIn Hamachi binary to load and launch a rogue DLL that’s responsible for executing the main payload.Microsoft Exchange ServerBitdefender linked a multi-wave intrusion against an Azerbaijani oil and gas company to FamousSparrow, a China-nexus threat actor, with repeated exploitation of the same Microsoft Exchange Server entry point.