CERT24FamousSparrow expanded its targeting to Azerbaijani energy infrastructure
Chinese-linked FamousSparrow targeted an Azerbaijani oil and gas company in three intrusion waves from late December 2025 through late February 2026. The attackers repeatedly used the same vulnerable Microsoft Exchange Server and deployed Deed RAT while attempting to deploy Terndoor.