Loading story…
A China-linked threat actor tracked as FamousSparrow and UAT-9244 repeatedly compromised an unnamed Azerbaijani oil and gas company in a multi-wave campaign that ran from late December 2025 through late February 2026. Bitdefender assessed with moderate-to-high confidence that the attackers gained initial access by exploiting a vulnerable Microsoft Exchange Server, likely through the ProxyNotShell chain, and repeatedly re-entered the environment even after remediation efforts. The targeting expands the group's known victimology into Azerbaijan, a country with growing strategic importance to European energy security.
Across three intrusion waves, the operators deployed or attempted to deploy Deed RAT (also known as Snappybee), TernDoor, and a modified version of Deed RAT, while using web shells, lateral movement, and redundant footholds to preserve access. Researchers also reported an evolved DLL side-loading technique that abused the legitimate LogMeIn Hamachi binary to help evade defenses. The operation was described as sustained and adaptive, with the attackers changing payloads and persistence methods while continuing to exploit the same Exchange entry point.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
By May 2026, Bitdefender publicly attributed the multi-wave intrusion to FamousSparrow with moderate-to-high confidence, noting that the campaign expanded the group's known targeting into Azerbaijan's strategically important energy sector.
Across three distinct waves ending in late February 2026, the operators deployed or attempted to deploy Deed RAT, then TernDoor, and later a modified Deed RAT, while using web shells, lateral movement, redundant footholds, and an evolved DLL side-loading technique involving LogMeIn Hamachi.
Between late December 2025 and late February 2026, the attackers repeatedly re-entered the victim environment through the same Exchange entry point even after remediation efforts, showing sustained and adaptive access operations.
In late December 2025, a China-linked threat actor tracked as FamousSparrow/UAT-9244 gained initial access to an unnamed Azerbaijani oil and gas company by exploiting a vulnerable Microsoft Exchange Server, likely via the ProxyNotShell chain.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcescworld.com
Open sourcethehackernews.com
Open sourcebusinessinsights.bitdefender.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kaspersky reported that several interconnected pro-Ukrainian hacktivist groups, including **4BID**, **Hacker kiт**, **C.A.S**, and **Goffee**, expanded attacks beyond Russia and Belarus to targets in **Kazakhstan, the UAE, Syria, and Egypt**. Victims included government entities, healthcare organizations, and the aviation sector. Researchers said the intrusions commonly began with exploitation of Microsoft Exchange **ProxyShell** vulnerabilities, followed by deployment of the `fd.aspx` ASP.NET web shell, execution of PowerShell or `cmd.exe`, reconnaissance, and installation of remote-management tools such as AnyDesk, Dev Tunnels, Panorama9, Tactical RMM, and Nezha Monitoring. The campaigns used a broad post-compromise toolkit that mixed public C2 frameworks and custom malware, including **Sliver**, **Havoc**, **Mythic Apollo**, **AdaptixC2**, **BlackSalt** backdoor, **Warp RAT**, **BlackReaperRAT**, **ClearWater** ransomware, and an updated **Blackout Locker**. Investigators also observed BYOVD-based EDR killers, including modified EDRKiller variants and GhostDriver, along with signs that some delivery scripts may have been AI-generated. ClearWater was seen encrypting files with **ChaCha20** and **RSA-2048**, dropping ransom notes, changing wallpapers, and deleting recovery artifacts, while Blackout Locker added a persistent screen-locking feature, reinforcing researchers' assessment that the actors are shifting from politically branded hacktivism toward financially motivated operations.
Jun 29, 2026
Threat actors used unpatched **Microsoft Exchange** servers as an initial access point to deploy both **Babuk** and **Cuba** ransomware, with campaigns heavily affecting organizations in the United States and additional victims in other countries. Cisco Talos reported that a newer actor it tracks as **Tortilla** likely exploited **ProxyShell** to compromise Exchange, install the **China Chopper** web shell, stage payloads with PowerShell, and ultimately launch Babuk ransomware that appended the `.babyk` extension after disabling backup-related services and deleting VSS snapshots. A separate intrusion set tied to **Cuba ransomware** also abused Exchange flaws, including **ProxyShell** and **ProxyLogon**, to breach corporate networks and deploy ransomware at scale. Mandiant said the actors, tracked as **UNC2596** and associated with **COLDDRAW**, combined public Exchange exploitation with tools such as **Bughatch**, **Wedgecut**, **Burntcigar**, and **Termite** to maintain persistence, escalate privileges, move laterally, and disable defenses; the activity followed earlier FBI reporting that Cuba had compromised dozens of U.S. critical infrastructure organizations, underscoring the continued risk from internet-exposed, unpatched Exchange servers.
Sep 3, 2026
Researchers reported intrusions against Middle East government environments that abused unpatched Microsoft collaboration servers to gain long-term access. One campaign documented by Secureworks exploited **Microsoft Exchange** vulnerability `CVE-2020-0688`, deploying multiple web shells, reusing compromised administrator credentials, moving between Exchange and SharePoint servers, dumping credentials from a certificate authority server and domain controller, and exfiltrating data through a compromised Exchange host. Secureworks said the activity persisted through at least April 2021 and assessed with moderate confidence that the Exchange-related operation was likely tied to an Iranian threat group, possibly **COBALT GYPSY**. The reporting also linked the victim set to earlier exploitation of **Microsoft SharePoint**. Secureworks found a separate 2019 compromise that abused `CVE-2019-0604` on SharePoint and concluded it was likely unrelated to the later Exchange intrusion, indicating different threat actors targeted the same environment over time. Separate reporting from Palo Alto Networks Unit 42 described **Emissary Panda** attacks against Middle East government SharePoint servers, underscoring how exposed SharePoint and Exchange systems in the region were repeatedly used as entry points for espionage-focused operations.
Aug 15, 2026