FamousSparrow Expands Targeting, Hits Azerbaijani Energy Firm via Exchange

The Hacker News reports that a threat actor, attributed by Bitdefender with moderate-to-high confidence to the China-linked group FamousSparrow (UAT-9244), executed a “multi-wave intrusion” against an unnamed Azerbaijani oil and gas company. This campaign, active between late December 2025 and late February 2026, utilized Microsoft Exchange exploits, signaling an expansion of FamousSparrow’s operational scope.

This isn’t a new tactic; FamousSparrow has a track record of leveraging Microsoft Exchange vulnerabilities. Their persistence against a critical infrastructure target like an energy firm underscores a strategic objective beyond simple data exfiltration. Expect intelligence gathering or pre-positioning for future disruptive operations.

The repeated exploitation of Exchange servers by a sophisticated actor like FamousSparrow demonstrates that many organizations still struggle with fundamental patch management and hardening. Attackers will keep hitting the same vulnerable points as long as they remain effective. This group isn’t just opportunistic; they’re methodical and persistent.