Azerbaijani Energy Firm Hit by Repeated Microsoft Exchange Exploitation

Bitdefender attributes a multi-wave cyber‑espionage campaign against an Azerbaijani oil and gas company (Dec 2025–Feb 2026) to FamousSparrow (UAT-9244), which exploited a Microsoft Exchange ProxyNotShell chain to repeatedly regain access, deploy web shells and two backdoors (Deed RAT/Snappybee and TernDoor) via evolved DLL side‑loading and loaders like Mofu, performed lateral movement to establish resilient footholds, and used C2 infrastructure (e.g., sentinelonepro.com); the activity demonstrates sustained, adaptive targeting of critical energy infrastructure.