ctipilot.ch

FamousSparrow (UAT-9244) three-wave intrusion of Azerbaijani oil & gas operator Dec 2025 – Feb 2026; ProxyNotShell re-exploit + novel two-stage export-gated DLL sideloading

campaign · campaign:famoussparrow-azerbaijan-2026

Coverage timeline
1
first 2026-05-14 → last 2026-05-14
Briefs
1
1 distinct
Sources cited
5
5 hosts
Sections touched
1
deep_dive
Co-occurring entities
0
no co-occurrence

Story timeline

  1. 2026-05-14CTI Daily Brief — 2026-05-14
    deep_diveDeep dive — China-nexus FamousSparrow re-used CVE-2022-41040/CVE-2022-41082 chain across three waves at one victim; introduced novel sandbox-evading DLL sideloading via LogMeIn Hamachi binary with payload gated on legitimate-app export call graph. Azerbaijan -> EU energy-supply intelligence relevance.

Where this entity is cited

  • deep_dive1

Source distribution

  • advisories.ncsc.nl1 (20%)
  • bitdefender.com1 (20%)
  • github.com1 (20%)
  • helpnetsecurity.com1 (20%)
  • thehackernews.com1 (20%)

All cited sources (5)

Items in briefs about FamousSparrow (UAT-9244) three-wave intrusion of Azerbaijani oil & gas operator Dec 2025 – Feb 2026; ProxyNotShell re-exploit + novel two-stage export-gated DLL sideloading

No parsed item heading or body matches this entity yet. Items match by exact CVE id (for CVE entities), by lead-segment substring of the title in the item heading or body, or by a distinctive anchor token from the title appearing in the item heading. Coverage that lives inside a broader section (no per-item heading) is captured by the Story timeline above.