Feral Wolf Ransomware Attacks Exploit Atlassian Confluence and Misconfigured 1C Systems

Feral Wolf is using exposed business software and weak server settings to reach corporate networks, then locking files with ransomware. The campaign shows how one overlooked internet-facing system can become the starting point for a much larger incident.

The group targeted Russian organizations in retail, construction, manufacturing, and information technology from May through August 2026. Its operators combined exploitation, stolen or weak credentials, remote access, and custom backdoors before deploying GenieLocker to encrypt data.

Analysts at BI.ZONE identified the activity while investigating the intrusions, documenting paths through vulnerable Atlassian Confluence installations, contractor environments, and poorly protected 1C:Enterprise clusters. The cases underline why external services need the same attention as core business systems.

BI.ZONE said in a report shared with Cyber Security News (CSN) that the operators also used legitimate-looking communication channels to remain active longer. That choice can make hostile traffic blend in with routine network activity and delay a defender’s response.

Feral Wolf Ransomware

One intrusion began with a publicly accessible Confluence server running inside a Docker container behind a proxy. Feral Wolf exploited CVE-2023-22515, created an account, and placed it in the Confluence administrator group.

Earlier coverage of the actively exploited Atlassian zero-day flaw illustrates why exposed collaboration platforms require rapid patching and regular account reviews.

From the container, the attackers established a foothold, ran network discovery, and found a PostgreSQL service using a weak password.

Access to that database gave them a route from the restricted container to the underlying host, where they ran commands and continued scanning the internal network.

The operation also abused insecure 1C:Enterprise server clusters exposed online. Where cluster administration was not protected, the attackers could connect to the management service and perform administrative actions without first proving their identity.

They then used specially prepared 1C database content or external processing files to make the server run operating-system commands.

A separate incident involved a cluster manager operating in debug mode. Its extra functions could be misused to launch external applications, leaving temporary command files as a potential warning sign.

These paths resemble the risks in Confluence server ransomware intrusions, where an initial application compromise rapidly becomes broader network access.

Backdoors, credential theft, and defense

After gaining access, Feral Wolf used newly documented backdoors that communicate through MQTT and Matrix, alongside a proxy utility that tunnels traffic through an existing Remote Desktop Protocol session.

By relying on widely used protocols rather than an unusual connection method, the group made command-and-control traffic harder to separate from normal activity. The attackers also collected memory from Windows systems with legitimate utilities and examined it for credentials.

In another case, they attempted to erase evidence using a PowerShell script designed to remove forensic traces. These actions can help an intruder move between systems while limiting the clues available to incident responders.

Organizations should patch Confluence promptly, remove unnecessary public access, and review administrator accounts and proxy logs.

Teams running 1C should require strong cluster administrator authentication, keep management services off the public internet, and disable debug capabilities unless they are essential.

Segmenting database and container-host networks also reduces the damage when one application is breached. Security teams should watch for unexpected administrative changes, suspicious outbound traffic over otherwise permitted protocols, unusual Remote Desktop activity, and creation of memory dumps.

Monitoring events across servers, containers, identity systems, and network boundaries can surface the linked actions earlier. The Docker host compromise risk is especially relevant when a compromised workload can reach services outside its intended isolation.

The investigation is a reminder that ransomware is rarely a single-event failure. Feral Wolf paired known flaws and configuration gaps with credential access, covert communications, and data encryption.

Closing exposed entry points and detecting the movement that follows are equally important to stopping the attack before its final stage.

That discipline matters because routine checks can connect internet exposure, configuration changes, administrator behavior, anomalous remote activity, and abnormal internal access before encryption begins.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC