Kiran 
A Russian-linked threat actor tracked as Feral Wolf has built a new arsenal of backdoors that disguise command-and-control traffic as ordinary messaging protocol activity.
Feral Wolf targeted retail, construction, manufacturing, and information technology companies in Russia.
Bi.zone found the group used at least three distinct entry points: exploiting CVE-2023-22515 in an internet-exposed Atlassian Confluence instance, compromising trusted contractor infrastructure, and abusing insecure 1C: Enterprise cluster manager configurations that allowed unauthenticated administrative actions.
Feral Wolf Hides C2 Traffic in MQTT
In the 1C cases, attackers connected to exposed cluster manager ports, created or hijacked databases, and used them to run operating system commands through malicious external processing files such as 1C-Shell and Obrabotka_bez_svedeniy.epf.
The campaign’s most notable development is a pair of Rust-based backdoors purpose-built to hide inside application-layer protocols that security teams rarely scrutinize.
MQTTDoor, distributed as cplsupport.exe, communicates over MQTT using the public HiveMQ broker, pulling PowerShell commands from a /cmd/req topic and returning results and telemetry through /cmd/res, /status, and /metrics.
MatrixDoor, distributed as wtas.exe, instead rides the Matrix protocol, authenticating to a homeserver and exchanging commands and results as custom message types inside a chat room.
Both tools protect their configurations with ChaCha20 encryption keyed to the infected machine’s MachineGuid registry value, so the malware only decrypts and runs on its intended target.
Both also register as disguised Windows services “Problem Reports Control Panel” and “Windows Telemetry Aggregator Service” to blend into normal system processes while persisting across reboots.
Rather than deploying flagged tools like Mimikatz, Feral Wolf used the legitimate Magnet DumpIt and MemProcFS utilities to capture and mount memory dumps, then browsed the resulting virtual file system directly to the lsass.exe process to harvest credentials, a technique designed to slip past antivirus signatures tuned for known dumping tools.
For lateral movement, the group introduced RDPSocksProxy, a C++ SOCKS4/5 proxy tunneled through an RDP Dynamic Virtual Channel, letting attackers pivot across networks inside what looks like a normal remote desktop session.
Forensic cleanup relied on the open-source nyx.ps1 script, fetched and executed directly in memory via PowerShell to wipe event logs, prefetch data, and other artifacts. The intrusions culminated in deploying GenieLocker ransomware to encrypt victim data.
“Feral Wolf’s shift toward MQTT and Matrix isn’t just clever engineering; it’s a bet that defenders still treat ‘normal’ protocols as inherently safe.”
Because these backdoors abuse legitimate, whitelisted protocols, defenders should move beyond signature matching: inspect MQTT broker connections and Matrix homeserver traffic from unexpected hosts, flag PowerShell or CMD processes spawned by services with generic-sounding display names, and monitor RDP sessions carrying anomalous dynamic virtual channel data.
Locking down 1C cluster manager authentication, patching Confluence promptly, and auditing outbound connections to public messaging brokers would have blunted several stages of this campaign.
Organizations exposed to Russian retail, construction, manufacturing, or IT sector risk profiles should treat Feral Wolf’s toolkit update as a signal to revisit assumptions about which network protocols deserve deep inspection.
About the Author
George antony 
