A ransomware group known as Feral Wolf is exploiting vulnerable collaboration servers and poorly secured business applications to enter corporate networks before deploying GenieLocker. Investigations into attacks against Russian retail, construction, manufacturing, and technology organizations show how exposed software, weak passwords, and permissive internal connectivity can turn an initial application compromise into a wider encryption event.

BI.ZONE observed the activity between May and August 2026. The operators used more than one entry path, including vulnerable Atlassian Confluence installations, contractor environments, and internet-accessible 1C:Enterprise clusters. After gaining access, they combined discovery, credential collection, custom backdoors, and legitimate remote-access techniques to maintain control.

Confluence flaw opens the first door

In one case, the target exposed a Confluence server running in a Docker container behind a proxy. Feral Wolf exploited CVE-2023-22515, created a new account, and added it to the Confluence administrator group. The attackers then surveyed the environment and discovered a PostgreSQL service protected by a weak password.

Database access provided a route beyond the restricted workload. From there, the operators reached the underlying host, executed commands, and scanned the internal network for further targets. The incident demonstrates that containerization is not a complete boundary when a compromised application can authenticate to services outside the container or when surrounding credentials and network rules are weak.

Misconfigured 1C services offer another route

Other intrusions took advantage of 1C:Enterprise server clusters whose management interfaces were exposed online without strong administrative authentication. That configuration allowed remote users to connect to management services and perform sensitive actions. Specially prepared database content or external processing files could then cause the server to execute operating-system commands.

Investigators also found a cluster manager running with debugging enabled. The additional debugging functions could be misused to launch external applications, potentially leaving temporary command files as a useful forensic clue. These cases did not depend on a novel exploit; preventable exposure and unsafe configuration supplied the attacker with privileged functionality.

Covert channels support movement and persistence

After establishing access, Feral Wolf deployed recently documented backdoors that communicate through MQTT and Matrix. The group also used a proxy tool that tunnels traffic over an existing Remote Desktop Protocol session. Because those protocols may already be permitted for legitimate activity, malicious command traffic can be harder to distinguish from ordinary communications.

The operators dumped Windows memory with legitimate utilities and searched the results for credentials that could support lateral movement. In another incident, they ran a PowerShell script intended to erase forensic traces. The combination suggests an operation focused on maintaining access long enough to map the network, acquire stronger identities, and position ransomware rather than immediately encrypting the first compromised machine.

Breaking the chain before encryption

Defenders should treat exposed enterprise applications as part of the security perimeter, even when they run inside a container or support a specialized business process. Priority actions include:

• Patch Confluence promptly and remove unnecessary public access.
• Review administrator accounts, proxy logs, and unexpected account creation.
• Require strong authentication for 1C cluster administration and keep management services off the internet.
• Disable debugging features unless an active operational requirement justifies them.
• Segment databases, containers, hosts, and user networks to constrain movement after compromise.
• Alert on memory dumps, temporary command files, unusual RDP tunneling, and unexpected MQTT or Matrix traffic.

Feral Wolf’s campaign illustrates why ransomware is usually the final visible stage of a longer intrusion. The group linked a known Confluence weakness and insecure 1C services with credential access, stealthy communications, and evidence removal. Rapid patching closes some doors, but defenders also need monitoring that connects application events, identity changes, host behavior, and network movement early enough to stop the operation before GenieLocker reaches critical data.