Between May and August 2026, investigators linked a series of Russian-targeted ransomware intrusions to exploitation of internet-facing Atlassian Confluence instances and poorly protected 1C:Enterprise clusters, followed by covert command channels, credential theft, and deployment of GenieLocker.
The campaign shows how one overlooked internet-facing system can become the starting point for a much larger incident.
Its operators combined exploitation, stolen or weak credentials, remote access, and custom backdoors before deploying GenieLocker to encrypt data.
The investigation is a reminder that ransomware is rarely a single-event failure.
# What happened
# How the intrusions began
Separately, attackers abused 1C:Enterprise cluster management services that were exposed and not protected by strong authentication. In some cases a cluster manager was left in debug mode, which provides extra functions that can launch external applications and leave temporary command files—an observable symptom if monitored.
# Post-exploitation and persistence
After gaining footholds, Feral Wolf used custom backdoors that communicate over MQTT and Matrix, and a proxy utility that tunnels traffic through an existing RDP session. By using common protocols and RDP-based tunneling, they made command-and-control traffic resemble normal network activity.
Techniques used during lateral movement and persistence included:
The campaign culminated in deployment of GenieLocker ransomware once they had the necessary access and credential material.
# Concrete indicators and patterns
BI.ZONE published at least one IP indicator tied to the Confluence intrusion: 45.151.45[.]31. The observable chain in multiple incidents was: public app exploit or exposed management → account creation or admin actions → weak-credential access to database services → container-to-host command execution → internal scanning and credential harvesting → covert C2 and tunneling → encryption.
# Practical defensive steps
# Bottom line
These incidents show a familiar but important point: a single overlooked internet-facing application or misconfigured management service can provide a direct path to broader network compromise. Closing exposed entry points, enforcing strong administrative controls, segmenting networks, and monitoring for covert-but-permitted traffic reduce the chance that an initial application breach becomes a ransomware event.
Feral Wolf has targeted Russian organizations through exposed Confluence servers, insecure 1C configurations, and compromised contractors, ultimately deploying ransomware. The campaign exploited the Atlassian Confluence vulnerability CVE-2023-22515. What is the threat? Feral Wolf is a financially motivated ransomware g
Feral Wolf has expanded its ransomware tradecraft by abusing exposed Atlassian Confluence servers and insecure 1C:Enterprise deployments to gain access to Russian corporate networks before deploying GenieLocker ransomware. The campaign, tracked from May through August 2026, targeted organizations in the retail, constru
A critical vulnerability impacting Orkes Conductor is being actively exploited in the wild, according to Fortinet. The vulnerability in question is CVE-2026-58138 (CVSS v3.1 score: 9.8/CVSS v4 score: 9.3), which relates to a case of unauthenticated remote code execution. "Orkes Conductor 3.21.21 before 3.30.2 contains
Cisco Talos says two recently patched Secure Firewall Management Center (FMC) vulnerabilities have been exploited by three separate threat clusters linked to ransomware and state-sponsored attacks. [...]
Cisco has revealed that three distinct threat clusters linked to ransomware and state-sponsored attacks have been exploiting two recently patched Secure Firewall Management Center (FMC) vulnerabilities. The attacks leverage CVE-2026-20079 (CVSS score: 10.0), an authentication bypass vulnerability in the web interface o
This edition of the weekly cybersecurity newsletter bulletin covers critical zero-day discoveries, nation-state router compromises, emerging autonomous AI attack vectors, and major cloud identity incidents. Below are detailed summaries of the top developments impacting enterprise defense and threat landscapes this week
Loading more related stories...
Open the app view to save this story, compare related coverage, and continue from the same source.