Deed RAT and TernDoor multi-wave deployment
Malware Activity
Summary
Hide ▲
Show ▼
A multi-wave malware deployment delivered Deed RAT (Snappybee) and TernDoor into an Azerbaijani oil and gas company across three waves, creating repeated footholds inside the network. The activity reused Microsoft Exchange Server access via the ProxyNotShell chain and relied on DLL side-loading to launch payloads. The repeated payload swaps and re-entry attempts increased persistence risk and made remediation harder.
Related Happenings
FamousSparrow multi-wave intrusion campaign against Azerbaijani oil and gas company
Campaign
H score39
First: 13.05.2026 16:00
Last: 13.05.2026 16:00
Sources 1
How related:
A threat actor with affiliations to China has been linked to a "multi-wave intrusion" targeting an unnamed Azerbaijani oil and gas company between late December 2025 and late February 2026, marking an expansion of its targeting.
About this happening:
A China-affiliated actor tracked as FamousSparrow (UAT-9244) ran a multi-wave intrusion against an unnamed Azerbaijani oil and gas company from late December 202...
FamousSparrow multi-wave intrusion campaign against Azerbaijani oil and gas company
CampaignHow related: A threat actor with affiliations to China has been linked to a "multi-wave intrusion" targeting an unnamed Azerbaijani oil and gas company between late December 2025 and late February 2026, marking an expansion of its targeting.
About this happening: A China-affiliated actor tracked as FamousSparrow (UAT-9244) ran a multi-wave intrusion against an unnamed Azerbaijani oil and gas company from late December 202...
FamousSparrow Azerbaijanian oil-and-gas targeting campaign
Campaign
H score32
First: 13.05.2026 16:00
Last: 13.05.2026 16:00
Sources 1
About this happening:
The China-linked FamousSparrow group ran a targeted cyberespionage campaign against an Azerbaijanian oil-and-gas company in the South Caucasus, highlighting a new...
FamousSparrow Azerbaijanian oil-and-gas targeting campaign
CampaignAbout this happening: The China-linked FamousSparrow group ran a targeted cyberespionage campaign against an Azerbaijanian oil-and-gas company in the South Caucasus, highlighting a new...
External Microsoft Teams helpdesk-impersonation campaign
Campaign
H score32
First: 20.04.2026 18:11
Last: 20.04.2026 18:11
Sources 1
About this happening:
A campaign abusing external Microsoft Teams collaboration is letting attackers impersonate IT/helpdesk staff, gain remote access, and stage targeted data exfiltratio...
External Microsoft Teams helpdesk-impersonation campaign
CampaignAbout this happening: A campaign abusing external Microsoft Teams collaboration is letting attackers impersonate IT/helpdesk staff, gain remote access, and stage targeted data exfiltratio...
UAT-9244 TernDoor, PeerTime, and BruteEntry malware activity
Malware Activity
H score22
First: 06.03.2026 01:19
Last: 06.03.2026 01:19
Sources 1
About this happening:
A China-linked malware cluster has been using TernDoor, PeerTime, and BruteEntry to compromise telecommunication providers in South America and turn infected s...
UAT-9244 TernDoor, PeerTime, and BruteEntry malware activity
Malware ActivityAbout this happening: A China-linked malware cluster has been using TernDoor, PeerTime, and BruteEntry to compromise telecommunication providers in South America and turn infected s...
Fake IT support Havoc campaign
Campaign
H score32
First: 03.03.2026 19:15
Last: 03.03.2026 19:15
Sources 1
About this happening:
A fake IT support campaign is using email spam, phone-based social engineering, and Havoc C2 to gain initial access, putting targeted organizations at risk of data e...
Fake IT support Havoc campaign
CampaignAbout this happening: A fake IT support campaign is using email spam, phone-based social engineering, and Havoc C2 to gain initial access, putting targeted organizations at risk of data e...
Timeline
-
13.05.2026 16:00 1 articles · 2mo ago
December 25, 2025 Deed RAT deployment via Microsoft Exchange
Exploitation ObservedThe unnamed Azerbaijani oil and gas company was accessed through a vulnerable Microsoft Exchange Server entry point using the ProxyNotShell chain, and Deed RAT (aka Snappybee) was deployed on December 25, 2025.
Show sources
- Azerbaijani Energy Firm Hit by Repeated Microsoft Exchange Exploitation — thehackernews.com — 13.05.2026 16:00
-
13.05.2026 16:00 2 articles · 2mo ago
FamousSparrow linked to repeated Microsoft Exchange intrusion against Azerbaijani oil and gas company
Attribution UpdateA moderate-to-high confidence attribution links FamousSparrow (aka UAT-9244) to a sustained multi-wave intrusion against the unnamed Azerbaijani oil and gas company from late December 2025 to late February 2026, with repeated reuse of the same Microsoft Exchange Server access path, web shell attempts, DLL side-loading via the legitimate LogMeIn Hamachi binary, a failed TernDoor delivery attempt through Mofu Loader, and a later modified Deed RAT wave accompanied by lateral movement to preserve access.
Show sources
- Azerbaijani Energy Firm Hit by Repeated Microsoft Exchange Exploitation — thehackernews.com — 13.05.2026 16:00
- Azerbaijani Energy Firm Hit by Repeated Microsoft Exchange Exploitation — thehackernews.com — 13.05.2026 16:00