Loading story…
Feral Wolf compromised Russian retail, construction, manufacturing, and IT organizations from May through August 2026, ultimately encrypting data with GenieLocker ransomware. Initial access paths included exploitation of Atlassian Confluence vulnerability CVE-2023-22515, insecure internet-exposed 1C:Enterprise cluster configurations, and compromised contractor infrastructure; the operators also moved from containers to hosts, abused weak PostgreSQL credentials, and dumped LSASS memory to obtain credentials.
BI.ZONE identified three previously unknown Feral Wolf tools: MQTTDoor, MatrixDoor, and RDPSocksProxy. MQTTDoor and MatrixDoor are Rust-based Windows service backdoors that use ostensibly legitimate MQTT and Matrix communications for encrypted command-and-control, with ChaCha20-protected data tied to the victim host's MachineGuid; RDPSocksProxy tunnels traffic through RDP. The group used these tools alongside anti-forensic cleanup to conceal persistence, lateral movement, and data-encryption operations.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
Between May and August 2026, Feral Wolf targeted Russian retail, construction, manufacturing, and IT organizations. The intrusions culminated in encryption of victim data using GenieLocker ransomware.
BI.ZONE identified three previously unknown Feral Wolf tools: the MQTTDoor and MatrixDoor Rust backdoors and the RDPSocksProxy tunneling tool. The tools use MQTT, Matrix, or RDP-based communications to conceal command-and-control and tunneling activity.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 19 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
BI.ZONE Threat Intelligence reported that the **Fluffy Wolf** cluster, also tracked as **Watch Wolf**, launched a new campaign against Russian companies in construction, consulting, engineering, retail, e-commerce, and industrial sectors. The attackers used phishing emails disguised as financial claims or debt-collection notices from partners or contractors, delivering malicious archives either directly or through GitHub links to make the messages appear legitimate and improve delivery past email filters. The campaign deployed a multi-stage malware chain that included a new C++ loader dubbed **PowerLoader**, which starts hidden PowerShell, retrieves scripts from a command server, and downloads **PureCrypter** to install final payloads. BI.ZONE said the operators used **PureLogs** for credential and data theft, a new **PureRAT** variant with the `PluginRemoteDesktop` module for remote access, and in at least one case deployed **Pay2Key** ransomware based on **Mimic**; researchers added that much of the toolset appears to have been sourced through malware-as-a-service offerings.
Jun 29, 2026
Researchers reported that the financially motivated **Toy Ghouls** group has deployed a new custom ransomware family, **GenieLocker**, against organizations in the Russian Federation, with manufacturing firms highlighted among the victims. Active since March 2026, the malware marks a shift away from third-party ransomware such as **RedAlert**, **LockBit**, and **Babuk** to a cross-platform encryptor built for **Windows**, **Linux**, and **VMware ESXi** environments. In a documented intrusion, the attackers reportedly entered through an **OpenVPN** connection belonging to a trusted external partner by using stolen valid credentials, then expanded access with **OpenSSH**, **SoftPerfect Network Scanner**, **Mimikatz**, **PsExec**, and **PAExec**. The Windows variant uses anti-debugging protections, requires a secret launch argument, terminates processes and services, and encrypts data with **libsodium** implementations of `XChaCha20-Poly1305` and `Curve25519-XSalsa20-Poly1305`, while the Linux/ESXi build includes ESXi-specific behavior such as modifying `/etc/vmware/welcome` and targeting `/vmfs/volumes`; researchers said the group typically focuses on encryption rather than data theft or leak-site extortion.
Aug 3, 2026
Researchers reported that a ransomware group tracked as **Crypt Ghouls** targeted Russian businesses and government agencies across mining, energy, finance, retail, and public-sector organizations. The group reportedly gained initial access through compromised contractor VPN credentials, then established persistence with **NSSM** and **Localtonet**, harvested credentials using **XenAllPasswordPro** and **Mimikatz**, and expanded access with reconnaissance and lateral-movement tools including **PingCastle**, **SoftPerfect Network Scanner**, **WMI**, **Impacket** `WmiExec.py`, and **PAExec`. The attackers deployed **LockBit 3.0** on Windows systems and **Babuk** on Linux and **ESXi** environments, indicating a multi-platform ransomware capability. Researchers also found overlaps in tooling, infrastructure, and tactics with activity linked to **MorLock**, **BlackJack**, **Twelve**, and **Shedding Zmiy/(Ex)Cobalt**, suggesting collaboration, shared tooling, or intelligence exchange among multiple groups focused on Russian targets.
Jun 29, 2026