#ParsedReport #CompletenessHigh
07-09-2026

Following the Trail of Feral Wolf: New Attack Tools and Techniques

https://bi.zone/expertise/blog/idem-po-sledam-feral-wolf-novye-instrumenty-i-tekhniki-atak/

Report completeness: High

Actors/Campaigns:
Feral_wolf

Threats:
1c-shell_tool
Mqttdoor
Matrixdoor
Rdpsocksproxy_tool
Genielocker
Dumpit_tool
Memprocfs_tool
Mimikatz_tool
Gsocket_tool
Pwnkit_tool
Copyfail_vuln
Fscan_tool
Revsocks_tool
Printspoofer_tool
Minidump_tool
Shadow_copies_delete_technique
Credential_dumping_technique

Victims:
Retail, Construction, Manufacturing, Information technology

Industry:
Retail

Geo:
Russian

TTPs:
Tactics: 11
Technics: 0

IOCs:
File: 20
IP: 2
Url: 1
Command: 2
Path: 3
Domain: 2
Registry: 4
Hash: 10

Soft:
fluence serv, onfluence in, ocker co, Confluence, Docker, inux ke, onfluence co, ux kern, PostgreSQL, rontab en, have more...

Algorithms:
chacha20, base64, ecdh, prng

Win API:
ZONE, SeImpersonatePrivilege

Languages:
powershell, rust

Links:
https://github.com/ly4k/PwnKit
have more...
https://github.com/kost/revsocks
https://github.com/hackerschoice/gsocket