Chinese APT Exploits Microsoft Exchange to Breach Energy Sector Network

Gbhackers •Mayura Kathir • May 14, 2026

Chinese state-aligned hackers compromised a Microsoft Exchange server at a major energy firm. They repeatedly reused that same entry point to run a months‑long espionage operation, deploying the Deed RAT and Terndoor backdoors to maintain deep access across the network. The activity is attributed with moderate‑to‑high confidence to FamousSparrow, a China‑aligned APT cluster that overlaps […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Chinese APT FamousSparrow Breaches Energy Sector via Microsoft Exchange Exploit Chinese state-aligned hackers, identified as FamousSparrow, infiltrated an Azerbaijani oil and gas company by exploiting an unpatched Microsoft Exchange server. The attack, which occurred from late December 2025 to late February 2026, involved deploying multiple backdoors, including Deed RAT and Terndoor, to maintain persistent access to the network. This espionage operation is notable for its duration and sophistication, marking it as one of the most detailed intrusions targeting energy infrastructure. The breach highlights vulnerabilities in critical infrastructure and the ongoing threat posed by state-sponsored actors. The full scope of the compromise and the extent of data exfiltration remain unclear, but the incident raises significant security concerns within the energy sector. 2 sources 73

Extracted Entities

Chinese APT Exploits Microsoft Exchange to Breach Energy Sector Network

The full story

Extracted Entities

APT Groups (1)

Attack Types (2)

Industries (1)

Malware (2)

Platforms (1)