📰 Chinese APT FamousSparrow Hits Azerbaijan Energy Sector with Deed RAT
🇨🇳 Chinese APT FamousSparrow targets Azerbaijan's energy sector. Campaign used Exchange exploits to deploy an updated Deed RAT for cyber-espionage, signaling new geopolitical targeting. 🇦🇿 #APT #China #CyberSecurity #EnergySector #FamousSparrow
🌐 cyber[.]netsecops[.]io
FamousSparrow nel Caucaso: tre ondate di spionaggio cinese colpiscono il gas azero che alimenta l’Europa
Il gruppo APT cinese FamousSparrow ha condotto un'operazione di cyberspionaggio in tre fasi successive contro una società petrolifera e del gas dell'Azerbaigian, sfruttando ripetutamente la stessa vulnerabilità di Microsoft Exchange. Un caso che illumina la strategia di Pechino per il controllo delle infrastrutture energetiche europee.
📢⚠️ China-linked #FamousSparrow hacking group targeted an oil and gas firm in #Azerbaijan using the ProxyNotShell exploit chain alongside Deed RAT and Terndoor malware across three persistent attack waves.
Read: https://hackread.com/famoussparrow-oil-gas-ms-exchange-server-exploit/
China-linked hackers exploit Microsoft Exchange in Azerbaijani energy firm attacks.
A group of China-linked hackers, known as FamousSparrow, launched a sustained cyberattack on an Azerbaijani oil and gas company, exploiting Microsoft Exchange vulnerabilities in a multi-wave intrusion that spanned three months. The attackers used the ProxyNotShell exploit to gain and maintain access to…
#ChinalinkedHackers #MicrosoftExchange #Proxynotshell #Famoussparrow #EarthEstries
FamousSparrow / SparrowDoor static analysis.
Legacy variant (2019-2022), SHA256: 8dfaa1f579...
4 findings not present in public vendor reporting
at time of analysis (ESET, UK NCSC, Trend Micro, Microsoft)
→ Inverted anti-sandbox logic
→ Three-table substitution system
→ .text section entropy anomaly
→ 113 indirect call sites in 26KB binary
Thread: [PHIM] findings only.
Full report: https://github.com/seraphimdeck/SerapHim-CTI
Happy Monday everyone!
Just got done reading an incredible article from ESET researchers describing an APT group that was long thought to be inactive alive in well! #FamousSparrow is a China-aligned APT group that has had no publicly documented activity since 2022 and was found using two previously undocumented versions of their backdoor, SparrowDoor. They used a mix of publicly available and custom tools for their attack ultimately leading to the deployment of SparrowDoor and ShadowPad (a privately sold backdoor). This report gets more and more interesting as you go so please go take the time to read it! Enjoy and Happy Hunting!
You will always remember this as the day you finally caught FamousSparrow
https://www.welivesecurity.com/en/eset-research/you-will-always-remember-this-as-the-day-you-finally-caught-famoussparrow/
Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday
China-linked APT group #FamousSparrow (aka Salt Typhoon) has resurfaced, targeting the US and LATAM orgs with an upgraded version of #SparrowDoor malware.
Read: https://hackread.com/china-famoussparrow-apt-americas-sparrowdoor-malware/
Famous Sparrow APT Group: Enhanced Cyber Arsenal and Global Threats
https://thedefendopsdiaries.com/famous-sparrow-apt-group-enhanced-cyber-arsenal-and-global-threats/
#famoussparrow
#aptgroup
#cyberespionage
#shadowpad
#cybersecurity
CyberNetsecIO
(in)sicurezza digitale
Hackread.com
securityaffairs
Analyst207
SerapHim
Marcel SIneM(S)US
Just Another Blue Teamer
The DefendOps Diaries