China's 'FamousSparrow' APT Nests in South Caucasus Energy Firm

China-linked APT group FamousSparrow has targeted an Azerbaijani oil-and-gas company in the South Caucasus region, marking the first known Chinese cyber operation in Azerbaijani industry. The attackers used an improved two-stage DLL sideloading technique to evade detection and deploy the Deed RAT remote access tool. The victim's failure to patch a vulnerable Microsoft Exchange server allowed FamousSparrow to return for two additional attacks after initial remediation. Researchers note possible links between FamousSparrow and Salt Typhoon but treat them as distinct clusters, potentially sharing tools via a centralized Chinese 'digital quartermaster.' The South Caucasus region has grown strategically important as an EU energy corridor, attracting new geopolitical cyber interest from China.