Feral Wolf Hackers Exploit Confluence and 1C to Deploy GenieLocker Ransomware
Feral Wolf exploited Atlassian Confluence and 1C:Enterprise flaws to deploy GenieLocker ransomware across Russian retail, construction, manufacturing and IT firms.
BI.ZONE DFIR tracked Feral Wolf intrusions at Russian retail, construction, manufacturing, and IT organizations from May through August 2026. The actor exploited CVE-2023-22515 on internet-facing Confluence instances, deployed GSocket and Rust-based MQTTDoor/MatrixDoor backdoors using MQTT and Matrix C2, and used PwnKit (CVE-2021-4034) and Copy Fail (CVE-2026-31431) for privilege escalation and container-to-host escape. The group abused exposed 1C:Enterprise cluster managers and weak PostgreSQL credentials to move laterally before deploying GenieLocker ransomware.
- Exploited CVE-2023-22515 on exposed Confluence, created an admin account, installed a malicious plug-in, deployed GSocket.
- Used PwnKit CVE-2021-4034 and Copy Fail CVE-2026-31431 for privilege escalation and Docker container-to-host escape.
- Rust backdoors MQTTDoor and MatrixDoor abuse HiveMQ and Matrix servers for C2; RDPSocksProxy tunnels via RDP channels.
- Stole credentials via Magnet DumpIt memory dumps examined with MemProcFS, avoiding conspicuous tools like Mimikatz.
- GenieLocker final stage encrypts data; defenders urged to patch Confluence and lock down 1C services.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1611 Escape to HostT1003.001 LSASS MemoryT1572 Protocol TunnelingT1486 Data Encrypted for Impact
- Threat actors
- Feral Wolf
- Malware
- GSocketMQTTDoorMatrixDoor
- Countries
- Russia
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-4034 | Out-of-Bounds Read/Write Local Privilege Escalation in polkit pkexec (PwnKit) | 7.8 | 95% | KEVRansomwarePoC ×4 | KEV |
| CVE-2023-22515 | Unauthenticated Broken Access Control in Atlassian Confluence Data Center/Server | 9.8 | 99% | KEVRansomwarePoC | KEV |
| CVE-2026-31431 | Local Privilege Escalation (Copy Fail) in Linux Kernel algif_aead Interface | 7.8 | 98% | KEVPoC ×12 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | bi.zone | d outbound traffic to public MQTT or Matrix infrastructure. BI.ZONE notes that effective incident response should include ident |
| domain | element.tw | r used the public HiveMQ broker, while MatrixDoor used meet.element[.]tw as its Matrix homeserver. Both can masquerade as legitima |
| ipv4 | 45.151.45.31 | ronment through a proxy server. The operation was traced to 45.151.45[.]31, an IP address associated with ProtonVPN infrastructure. |
| sha256 | 1e2e08a36b6126f2363c24b5fe7a6dbd755c35b1cb6f15cdea13fc93274019f3 | 307d154b2935703422d44f02e403d2e78 exploit_cve_2026_31431.py 1e2e08a36b6126f2363c24b5fe7a6dbd755c35b1cb6f15cdea13fc93274019f3 Note: IP addresses and domains are intentionally defanged ( |
| sha256 | 2539170c4c1ffeeb17e87917687b5f86104cc88de9478696cee6e0ecaddfc9bb | f1d937b721fad95c63374f7dd0570d1b1e9d96c41 gs-dbus (GSocket) 2539170c4c1ffeeb17e87917687b5f86104cc88de9478696cee6e0ecaddfc9bb gs-dbus (GSocket) cb5f62bf7b591e69bd38e6bf8e40e8d307d154b29 |
| sha256 | 487886e5058294b7d965421f1d937b721fad95c63374f7dd0570d1b1e9d96c41 | could enable recurrence. IOCs Indicator SHA-256 memfix.zip 487886e5058294b7d965421f1d937b721fad95c63374f7dd0570d1b1e9d96c41 gs-dbus (GSocket) 2539170c4c1ffeeb17e87917687b5f86104cc88de |
| sha256 | cb5f62bf7b591e69bd38e6bf8e40e8d307d154b2935703422d44f02e403d2e78 | 7687b5f86104cc88de9478696cee6e0ecaddfc9bb gs-dbus (GSocket) cb5f62bf7b591e69bd38e6bf8e40e8d307d154b2935703422d44f02e403d2e78 exploit_cve_2026_31431.py 1e2e08a36b6126f2363c24b5fe7a6dbd7 |
From the original article
4 min read at gbhackers.com
Feral Wolf has expanded its ransomware tradecraft by abusing exposed Atlassian Confluence servers and insecure 1C:Enterprise deployments to gain access to Russian corporate networks before deploying GenieLocker ransomware. The campaign, tracked from May through August 2026, targeted organizations in the retail, construction, manufacturing, and IT sectors. BI.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.