Bitdefender Documents China-Linked APT Group Expanding Operations Into Energy Sector

Bitdefender has published research documenting a cyber-espionage campaign by the China-aligned threat group FamousSparrow against an oil and gas company in Azerbaijan, marking the first known instance of the group targeting energy infrastructure.

The research details a multi-wave intrusion that ran between December 2025 and late February 2026. FamousSparrow had previously been known for operations targeting telecoms, government and technology organisations. The shift into energy infrastructure in the South Caucasus represents an expansion of the group’s geographic and sectoral footprint.

Geopolitical context

The targeting of Azerbaijani energy infrastructure comes at a sensitive moment for global energy supply chains. Azerbaijan’s role as an energy supplier to Europe has grown following the expiration of Russia’s Ukraine gas transit agreement and disruptions in the Strait of Hormuz that have constrained global energy flows.

As Europe diversifies its supply sources and Asia increases investment in LNG and renewable infrastructure, the systems managing energy production and distribution are becoming more complex and digitally dependent. Bitdefender argues this shift is expanding the attack surface faster than many organisations can secure it.

Three waves of intrusion

The campaign was sustained and adaptive, according to Bitdefender’s analysis. Attackers exploited vulnerabilities in a Microsoft Exchange server to gain initial access, then returned repeatedly over two months despite remediation efforts by the target organisation.

Across three distinct waves, the attackers deployed multiple backdoor families including Deed RAT and Terndoor. Bitdefender characterised the persistence and operational discipline as more consistent with long-term espionage than opportunistic attacks.

Novel evasion technique

A notable technical finding is the evolution of the Deed RAT malware. Bitdefender researchers identified a new DLL sideloading technique that delays malicious execution until legitimate application processes are fully underway.

This “execution gating” approach allows the malware to evade traditional detection tools. Bitdefender described it as part of a broader trend toward stealthier and more resilient attack methods among advanced persistent threat groups.

Incomplete remediation exploited

The research highlights a defensive gap that Bitdefender considers significant. The attackers repeatedly re-entered the target environment through the same initial access point, even after remediation had been attempted.

Bitdefender framed this as part of a broader pattern in advanced threat activity, where attackers no longer need new vulnerabilities. Instead, they exploit incomplete remediation and return through the same entry point.

Implications beyond the Caucasus

While the intrusion targeted an Azerbaijani company, Bitdefender argues the findings carry relevance for markets beyond the immediate region. Energy systems across the Asia-Pacific are increasingly digitised and exposed to the same classes of vulnerabilities.

For Australia, a significant energy partner to countries across Asia, the research underscores the need to secure digital infrastructure underpinning supply chains that extend beyond national borders.

The convergence of cyber-espionage and energy geopolitics raises the stakes for operators of critical infrastructure globally. Bitdefender notes that cyber operations are emerging as a parallel vector for influence, intelligence gathering and potential disruption as global energy systems become more contested.

Defensive recommendations

Bitdefender advises organisations operating critical infrastructure to prioritise patching of internet-facing systems, implement continuous monitoring for anomalous activity and adopt what it describes as a breach-assumption mindset focused on rapid detection and response.

The full research report is available on Bitdefender’s website.

Last Updated on May 15, 2026 by Nick Ross