Atlassian: Feral Wolf ransomware targets Russian firms using Confluence flaws

Feral Wolf Ransomware Group Exploits Confluence Flaws to Target Russian Organizations

The Feral Wolf ransomware group has launched a campaign against Russian organizations, exploiting exposed Atlassian Confluence servers, misconfigured 1C:Enterprise systems, and compromised contractor credentials to deploy GenieLocker ransomware. The attacks leverage CVE-2023-22515, a critical Confluence vulnerability, as an initial entry point, followed by privilege escalation using CVE-2021-4034 and CVE-2026-31431.

Feral Wolf, a financially motivated threat actor, conducts extensive reconnaissance before establishing persistent access. The group employs anti-forensic tools to erase logs and uses MQTT, Matrix, and RDP-based tunnels to obscure command-and-control traffic. Weakly secured 1C configurations and stolen credentials further enable lateral movement, leading to data encryption, operational disruption, and prolonged recovery efforts.

The campaign underscores the risks of unpatched software and exposed administrative interfaces, particularly in enterprise environments. Organizations are advised to prioritize patching, enforce strong authentication, and restrict direct internet access to critical systems. The findings were reported by Smarter MSP.

Source: https://www.msspalert.com/brief/feral-wolf-ransomware-group-targets-russian-firms-using-confluence-vulnerabilities

Atlassian cybersecurity rating report: https://www.rankiteo.com/company/atlassian

"id": "ATL1790785602",
"linkid": "atlassian",
"type": "Vulnerability",
"date": "10/2023",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'location': 'Russia', 'type': 'Organization'}],
 'attack_vector': ['Exploited Vulnerabilities',
                   'Compromised Credentials',
                   'Misconfigured Systems'],
 'data_breach': {'data_encryption': 'Data encryption',
                 'data_exfiltration': 'Potential data exfiltration'},
 'description': 'The Feral Wolf ransomware group has launched a campaign '
                'against Russian organizations, exploiting exposed Atlassian '
                'Confluence servers, misconfigured 1C:Enterprise systems, and '
                'compromised contractor credentials to deploy GenieLocker '
                'ransomware. The attacks leverage CVE-2023-22515, a critical '
                'Confluence vulnerability, as an initial entry point, followed '
                'by privilege escalation using CVE-2021-4034 and '
                'CVE-2026-31431. The group employs anti-forensic tools to '
                'erase logs and uses MQTT, Matrix, and RDP-based tunnels to '
                'obscure command-and-control traffic. Weakly secured 1C '
                'configurations and stolen credentials further enable lateral '
                'movement, leading to data encryption, operational disruption, '
                'and prolonged recovery efforts.',
 'impact': {'data_compromised': 'Data encryption and potential exfiltration',
            'downtime': 'Prolonged recovery efforts',
            'operational_impact': 'Operational disruption',
            'systems_affected': ['Atlassian Confluence Servers',
                                 '1C:Enterprise Systems']},
 'initial_access_broker': {'entry_point': ['Exploited Confluence Vulnerability '
                                           '(CVE-2023-22515)',
                                           'Misconfigured 1C:Enterprise '
                                           'Systems',
                                           'Compromised Contractor '
                                           'Credentials'],
                           'reconnaissance_period': 'Extensive reconnaissance '
                                                    'before establishing '
                                                    'persistent access'},
 'lessons_learned': 'The campaign underscores the risks of unpatched software '
                    'and exposed administrative interfaces, particularly in '
                    'enterprise environments.',
 'motivation': 'Financial Gain',
 'post_incident_analysis': {'root_causes': ['Unpatched software '
                                            '(CVE-2023-22515, CVE-2021-4034, '
                                            'CVE-2026-31431)',
                                            'Misconfigured 1C:Enterprise '
                                            'systems',
                                            'Compromised contractor '
                                            'credentials',
                                            'Exposed administrative '
                                            'interfaces']},
 'ransomware': {'data_encryption': 'Yes',
                'data_exfiltration': 'Potential',
                'ransomware_strain': 'GenieLocker'},
 'recommendations': 'Organizations are advised to prioritize patching, enforce '
                    'strong authentication, and restrict direct internet '
                    'access to critical systems.',
 'references': [{'source': 'Smarter MSP'}],
 'threat_actor': 'Feral Wolf',
 'title': 'Feral Wolf Ransomware Group Exploits Confluence Flaws to Target '
          'Russian Organizations',
 'type': 'Ransomware',
 'vulnerability_exploited': ['CVE-2023-22515',
                             'CVE-2021-4034',
                             'CVE-2026-31431']}