Feral Wolf Ransomware Exploits Atlassian Confluence and Misconfigured 1C Systems Against Russian Organizations
The Feral Wolf ransomware group is targeting Russian organizations by exploiting Atlassian Confluence CVE-2023-22515 and misconfigured 1C:Enterprise systems, leveraging custom backdoors and common protocols for command and control.
The Feral Wolf ransomware group has been actively targeting Russian organizations, including those in the retail, construction, manufacturing, and information technology sectors, from May through August 2026. Attackers gain initial access by exploiting vulnerabilities in Atlassian Confluence, specifically CVE-2023-22515, or by leveraging misconfigurations in 1C:Enterprise systems that are exposed to the internet. This campaign highlights how a single overlooked internet-facing system can serve as the entry point for a significant data breach and subsequent ransomware deployment.
BI.ZONE analysts observed that the threat actors combined multiple tactics, techniques, and procedures (TTPs) to achieve their objectives. These included exploiting known vulnerabilities, utilizing stolen or weak credentials, employing remote access tools, and deploying custom backdoors. The ultimate goal was to encrypt victim data using the GenieLocker ransomware.
One observed intrusion began with a publicly accessible Atlassian Confluence server running within a Docker container. The attackers successfully exploited CVE-2023-22515, created a new administrator account, and then used this foothold to discover a PostgreSQL service with a weak password. This allowed them to pivot from the isolated container environment to the underlying host system, enabling further network scanning and command execution.
In parallel, Feral Wolf abused insecure 1C:Enterprise server clusters that were exposed online. In cases where cluster administration was not adequately protected, attackers could connect to the management service and perform administrative actions without authentication. They then leveraged specially crafted 1C database content or external processing files to execute operating system commands, demonstrating a sophisticated approach to compromising business-critical applications.
Following initial access, Feral Wolf employed custom backdoors that communicated using the MQTT and Matrix protocols, alongside a proxy utility that tunneled traffic through existing Remote Desktop Protocol (RDP) sessions. This reliance on common and legitimate-looking protocols made command-and-control (C2) traffic difficult to distinguish from normal network activity, potentially delaying detection by security teams.
The attackers also focused on credential theft, using legitimate Windows utilities to dump system memory and extract credentials. To hinder incident response efforts, they also employed PowerShell scripts designed to erase forensic evidence, making it harder for investigators to trace their movements and understand the scope of the compromise.
BI.ZONE recommends that organizations promptly patch Atlassian Confluence, restrict unnecessary public access, and regularly review administrator accounts and proxy logs. For 1C systems, strong authentication for cluster administrators, keeping management services offline, and disabling debug capabilities are crucial. Network segmentation between database and host systems, as well as between containers and their hosts, can also limit the impact of a breach.
This campaign underscores the interconnected nature of modern cyberattacks, where a combination of unpatched vulnerabilities, configuration weaknesses, credential compromise, and covert communication channels can lead to significant data encryption and operational disruption. Proactive security measures, including continuous monitoring and robust defense-in-depth strategies, are essential to counter such multifaceted threats.