Feral Wolf Ransomware Attacks Exploit Atlassian Confluence and Misconfigured 1C Systems
BI.ZONE links Feral Wolf ransomware attacks on Russian firms to Confluence CVE-2023-22515 exploitation and exposed 1C clusters, deploying GenieLocker.
BI.ZONE documented Feral Wolf ransomware intrusions against Russian retail, construction, manufacturing and IT organizations from May through August 2026. Attackers exploited CVE-2023-22515 on internet-facing Atlassian Confluence servers, abused unauthenticated 1C:Enterprise cluster management and debug modes to execute OS commands, and escalated from a restricted Docker container to the host via a weak-password PostgreSQL service. They used newly documented MQTTDoor and MatrixDoor backdoors, an RDP-tunneling proxy, credential harvesting from memory dumps, and the GenieLocker encryptor, blending C2 into legitimate protocols to evade detection.
- Exploited CVE-2023-22515 to create an admin account on a Dockerized Confluence server
- Weak PostgreSQL password enabled container-to-host escape and further network discovery
- Unauthenticated 1C:Enterprise cluster management allowed arbitrary OS command execution
- MQTTDoor and MatrixDoor backdoors hide C2 in legitimate MQTT and Matrix traffic
- PowerShell scripts used to remove forensic traces; IoCs and GenieLocker hashes published
- CVEs
- CVE-2023-22515
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1078 Valid AccountsT1003 OS Credential DumpingT1572 Protocol TunnelingT1486 Data Encrypted for Impact
- Threat actors
- Feral Wolf
- Victims
- Russian organizations
- Organizations
- BI.ZONE
- Countries
- Russia
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-22515 | Unauthenticated Broken Access Control in Atlassian Confluence Data Center/Server | 9.8 | 99% | KEVRansomwarePoC | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | element.tw | ]com MQTT broker used by the MQTTDoor backdoor. Domain meet.element[.]tw Matrix homeserver used by the MatrixDoor backdoor. URL hx |
| domain | hivemq.com | QL server contacted by the 1C server process. Domain broker.hivemq[.]com MQTT broker used by the MQTTDoor backdoor. Domain meet.el |
| ipv4 | 45.151.45.31 | f compromise (IoCs):- Type Indicator Description IP address 45.151.45[.]31 Source IP associated with the Confluence intrusion. IP ad |
| ipv4 | 46.166.79.31 | rce IP associated with the Confluence intrusion. IP address 46.166.79[.]31 External PostgreSQL server contacted by the 1C server pro |
| sha256 | 023a8a4e54dd9264a7d0cca3fd08cae15c661c91bb477dfc08a5c0f9939fb5cb | 70e3ccc1123fc2fac9cf43862369f335 GenieLocker sample SHA-256 023a8a4e54dd9264a7d0cca3fd08cae15c661c91bb477dfc08a5c0f9939fb5cb GenieLocker sample SHA-256 588f817d9047f093ee8b68d1d50354a2 |
| sha256 | 1e2e08a36b6126f2363c24b5fe7a6dbd755c35b1cb6f15cdea13fc93274019f3 | 54b2935703422d44f02e403d2e78 gs-dbus GSocket sample SHA-256 1e2e08a36b6126f2363c24b5fe7a6dbd755c35b1cb6f15cdea13fc93274019f3 exploit_cve_2026_31431.py SHA-256 e82ecbe3823046a27d8c39cc0 |
| sha256 | 2539170c4c1ffeeb17e87917687b5f86104cc88de9478696cee6e0ecaddfc9bb | 1d937b721fad95c63374f7dd0570d1b1e9d96c41 memfix.zip SHA-256 2539170c4c1ffeeb17e87917687b5f86104cc88de9478696cee6e0ecaddfc9bb gs-dbus GSocket sample SHA-256 cb5f62bf7b591e69bd38e6bf8e40 |
| sha256 | 487886e5058294b7d965421f1d937b721fad95c63374f7dd0570d1b1e9d96c41 | pt-download location observed in attacker commands. SHA-256 487886e5058294b7d965421f1d937b721fad95c63374f7dd0570d1b1e9d96c41 memfix.zip SHA-256 2539170c4c1ffeeb17e87917687b5f86104cc88d |
| sha256 | 588f817d9047f093ee8b68d1d50354a2f5cd5d01451512bdb75d726e61e419fa | 5c661c91bb477dfc08a5c0f9939fb5cb GenieLocker sample SHA-256 588f817d9047f093ee8b68d1d50354a2f5cd5d01451512bdb75d726e61e419fa MQTTDoor SHA-256 c6a0476571cf67255001201be70f6fdfc3ac945515 |
| sha256 | b4c7e52bf47f8770683b13c6bdaee80924511673b94a6eb46157dffee8e92d05 | e70f6fdfc3ac945515c1c8b327a9a92a4e89991d MatrixDoor SHA-256 b4c7e52bf47f8770683b13c6bdaee80924511673b94a6eb46157dffee8e92d05 RDPSocksProxy Note: IP addresses and domains are intentiona |
| sha256 | c6a0476571cf67255001201be70f6fdfc3ac945515c1c8b327a9a92a4e89991d | d1d50354a2f5cd5d01451512bdb75d726e61e419fa MQTTDoor SHA-256 c6a0476571cf67255001201be70f6fdfc3ac945515c1c8b327a9a92a4e89991d MatrixDoor SHA-256 b4c7e52bf47f8770683b13c6bdaee80924511673 |
| sha256 | cb5f62bf7b591e69bd38e6bf8e40e8d307d154b2935703422d44f02e403d2e78 | c88de9478696cee6e0ecaddfc9bb gs-dbus GSocket sample SHA-256 cb5f62bf7b591e69bd38e6bf8e40e8d307d154b2935703422d44f02e403d2e78 gs-dbus GSocket sample SHA-256 1e2e08a36b6126f2363c24b5fe7a |
| sha256 | ccfc37014ce6183bb9268e15e8569fc870e3ccc1123fc2fac9cf43862369f335 | c39cc0a4acb498f415549946c9ff0e241838b34ed5a21 fscan SHA-256 ccfc37014ce6183bb9268e15e8569fc870e3ccc1123fc2fac9cf43862369f335 GenieLocker sample SHA-256 023a8a4e54dd9264a7d0cca3fd08cae1 |
| sha256 | e82ecbe3823046a27d8c39cc0a4acb498f415549946c9ff0e241838b34ed5a21 | 1cb6f15cdea13fc93274019f3 exploit_cve_2026_31431.py SHA-256 e82ecbe3823046a27d8c39cc0a4acb498f415549946c9ff0e241838b34ed5a21 fscan SHA-256 ccfc37014ce6183bb9268e15e8569fc870e3ccc1123fc |
| url | https://github.com/itm4n/PrintSpoofer/releases/download/v1.0/PrintSpoofer64.exe | .]tw Matrix homeserver used by the MatrixDoor backdoor. URL hxxps://github[.]com/itm4n/PrintSpoofer/releases/download/v1.0/PrintSpoofer64.exe Tool-download location observed in attacker commands. URL |
| url | https://raw.githubusercontent.com/evilsocket/nyx/refs/heads/main/nyx.ps1 | e Tool-download location observed in attacker commands. URL hxxps://raw.githubusercontent[.]com/evilsocket/nyx/refs/heads/main/nyx.ps1 Script-download location observed in attacker commands. S |
From the original article
4 min read at cybersecuritynews.com
Feral Wolf is using exposed business software and weak server settings to reach corporate networks, then locking files with ransomware. The campaign shows how one overlooked internet-facing system can become the starting point for a much larger incident. The group targeted Russian organizations in retail, construction, manufacturing, and information technology from May through August 2026.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.