Feral Wolf Hackers Exploit Confluence and 1C to Deploy GenieLocker Ransomware

Feral Wolf has expanded its ransomware tradecraft by abusing exposed Atlassian Confluence servers and insecure 1C:Enterprise deployments to gain access to Russian corporate networks before deploying GenieLocker ransomware.

The campaign, tracked from May through August 2026, targeted organizations in the retail, construction, manufacturing, and IT sectors.

BI.ZONE DFIR investigators found that the threat actor combined exploitation of public-facing applications, credential abuse, container-to-host lateral movement, covert command-and-control channels, and anti-forensic tooling to reach the encryption stage.

The activity highlights how exposed enterprise software and weak administrative configurations can provide ransomware operators with a direct path into critical infrastructure.

In one intrusion, Feral Wolf targeted an internet-accessible Confluence instance running inside a Docker container.

The attackers reportedly exploited CVE-2023-22515, an Atlassian Confluence vulnerability, after reaching the environment through a proxy server.

The operation was traced to 45.151.45[.]31, an IP address associated with ProtonVPN infrastructure.

After compromising Confluence, the attackers created an account, assigned it administrative privileges, and installed a malicious plug-in.

They then used command execution in the container to deploy GSocket, a reverse-connection utility designed to provide persistent remote access.

The malware was disguised as Linux kernel-related processes, including [kcached] and [rcu_preempt], through the exec -a command-line technique.

Feral Wolf also configured the GSocket payload to use port 53, a common DNS port that may help malicious traffic blend into normal network activity.

A second GSocket instance was installed as a fallback channel, giving the attackers redundancy if their primary access method failed.

The group subsequently uploaded exploits for PwnKit, tracked as CVE-2021-4034, and Copy Fail, CVE-2026-31431.

Copy Fail is a Linux local privilege-escalation flaw that may enable an attacker with unprivileged code execution in a container to compromise the underlying host when the required conditions exist.

The operators also used the fscan reconnaissance utility to identify exposed services and weak credentials.

That scan uncovered a PostgreSQL service using the weak postgres password 12345678.

Feral Wolf then deployed revsocks to tunnel traffic from the Confluence container and apparently used the discovered database credentials to move from the container into the Docker host.

The MatrixDoor backdoor, also written in Rust, was distributed as wtas.exe. The malware enables remote command execution on compromised hosts via the CMD interpreter.

On the host, the attackers established further persistence through modified shell-profile files and PostgreSQL cron jobs.

A separate intrusion chain focused on externally accessible 1C:Enterprise server clusters.

Feral Wolf connected to exposed cluster-manager services on TCP port 1541, associated with rmngr.exe, before interacting with rphost.exe processes on ports 1570–1571.

GenieLocker Ransomware

In affected environments, missing cluster-administrator controls or debug-mode configuration appeared to let the operators perform administrative actions without adequate authentication.

The attackers abused 1C-Shell database dumps and malicious external processing files to execute operating-system commands through the 1C platform.

They also attempted to deploy PrintSpoofer for local privilege escalation, although that effort failed because the compromised rphost.exe account lacked the required SeImpersonatePrivilege permission.

For credential theft, Feral Wolf relied on legitimate tools rather than more conspicuous credential-dumping malware.

The group used Magnet DumpIt to create a full physical memory image and MemProcFS to mount and examine the resulting dump, including artifacts linked to lsass.exe.

This technique could enable offline extraction of credentials from process memory while reducing dependence on tools such as Mimikatz.

The campaign also introduced three notable tools: MQTTDoor, MatrixDoor, and RDPSocksProxy. MQTTDoor and MatrixDoor are Rust-based backdoors that execute PowerShell or CMD commands while using MQTT and Matrix, respectively, for C2 communications.

MQTTDoor used the public HiveMQ broker, while MatrixDoor used meet.element[.]tw as its Matrix homeserver.

Both can masquerade as legitimate Windows services and encrypt configuration data using keys derived from the victim’s MachineGuid value.

RDPSocksProxy provides SOCKS4/5 proxying through an RDP Dynamic Virtual Channel, allowing attackers to tunnel traffic through an otherwise legitimate Remote Desktop Protocol session.

In the final phase, Feral Wolf used GenieLocker ransomware to encrypt victim data.

Defenders should urgently patch exposed Confluence deployments, restrict external access to 1C cluster-management services, enforce strong PostgreSQL credentials, and review 1C debug-mode usage.

Security teams should also hunt for suspicious service names such as cplsupport and wtas, unexpected GSocket binaries, altered shell profiles, memory-dump activity, and outbound traffic to public MQTT or Matrix infrastructure.

BI.ZONE notes that effective incident response should include identifying the root cause, isolating compromised systems, and investigating infrastructure misconfigurations that could enable recurrence.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC