Chinese APT FamousSparrow Weaponizes Evolved Deed RAT Against Azerbaijani Energy Infrastructure

Bitdefender Labs describes a multi-wave APT intrusion (Dec 2025–Feb 2026) against an Azerbaijani energy company attributed to FamousSparrow, using ProxyNotShell to drop web shells and deploy a stealthy Deed RAT via LogMeIn Hamachi DLL side‑loading, with a later attempted Terndoor kernel-driver deployment; the malware uses a two-stage in-memory hook to evade sandboxes and the final variant masqueraded C2 traffic over HTTPS to sentinelonepro.com:443, and the report recommends real-time memory scanning and monitoring suspicious service/driver creation.