Chinese-Linked Hackers Waged Multi-Wave Cyber Campaign Against Azerbaijani Energy Company
A threat actor with affiliations to China has been linked to a sustained intrusion campaign targeting an Azerbaijani oil and gas company between late December 2025 and late February 2026, according to research published by Bitdefender. The attackers, identified with moderate-to-high confidence as the group known as FamousSparrow (or UAT-9244), deployed a multi-wave approach that researchers say represents an expansion of the group's historical targeting patterns. The campaign exploited Microsoft Exchange servers as its primary entry point, suggesting the threat actor leveraged known vulnerabilities in widely deployed enterprise communication infrastructure to gain initial access.
The multi-wave nature of the intrusion indicates a methodical, patient adversary capable of maintaining persistent access over an extended period. Bitdefender's analysis suggests the threat actor adapted its tactics between intrusion waves, demonstrating operational flexibility consistent with state-linked espionage activity. While the specific Azerbaijani entity targeted was not named in the disclosure, the energy sector represents a strategically significant target given the country's role as a Caspian Basin hydrocarbon exporter and transit corridor. The timing of the campaign spans a period of heightened regional energy market volatility and competing geopolitical interests in South Caucasus energy infrastructure.
The incident adds to a growing pattern of Chinese-linked cyber operations targeting critical infrastructure in Central Asia and the broader Silk Road corridor. Microsoft Exchange exploitation remains a favored initial access vector among multiple threat actors due to the platform's ubiquity in enterprise environments and the complexity of patching cycles. Security researchers warn that organizations operating in strategic sectors across the region face elevated risk of similar campaigns, particularly those with delayed or incomplete patch management for Exchange environments.