Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
17 IOCs
Hunting Feral Wolf: new tools and techniques
Threat Actors
Malware Families
Excerpt
The threat actor uses backdoors that masquerade C2 communications as legitimate MQTT and Matrix traffic, impeding detection and extending dwell time Introduction From May through August 2026, Feral Wolf conducted a campaign against Russian companies in retail, construction, manufacturing, and information technology. While investigating these incidents, BI.ZONE DFIR identified several methods the adversaries employed to gain initial access to target infrastructures. In one…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(4)
Capability(3)
Victim
Indicators of Compromise
Open the mindmap →17 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | meet.element.tw | High | Score 63/100 | First seen |
| Domain | broker.hivemq.com | High | Score 58/100 | First seen |
| SHA256 | cb5f62bf7b591e69bd38e6bf8e40e8d307d154b2935703422d44f02e403d2e78 | Medium | Score 56/100 | First seen |
| SHA256 | e82ecbe3823046a27d8c39cc0a4acb498f415549946c9ff0e241838b34ed5a21 | High | Score 90/100 | First seen |
| SHA256 | 1e2e08a36b6126f2363c24b5fe7a6dbd755c35b1cb6f15cdea13fc93274019f3 | Medium | Score 53/100 | First seen |
| SHA256 | 487886e5058294b7d965421f1d937b721fad95c63374f7dd0570d1b1e9d96c41 | Medium | Score 53/100 | First seen |
| CVE | CVE-2026-31431 | High | Score 79/100 | First seen |
| SHA256 | 023a8a4e54dd9264a7d0cca3fd08cae15c661c91bb477dfc08a5c0f9939fb5cb | Medium | Score 53/100 | First seen |
| SHA256 | b4c7e52bf47f8770683b13c6bdaee80924511673b94a6eb46157dffee8e92d05 | Medium | Score 53/100 | First seen |
| CVE | CVE-2023-22515 | Medium | Score 51/100 | First seen |
| IP | 45.151.45.31 | High | Score 58/100 | First seen |
| SHA256 | 2539170c4c1ffeeb17e87917687b5f86104cc88de9478696cee6e0ecaddfc9bb | Medium | Score 53/100 | First seen |
| CVE | CVE-2021-4034 | High | Score 79/100 | First seen |
| IP | 46.166.79.31 | High | Score 58/100 | First seen |
| SHA256 | 588f817d9047f093ee8b68d1d50354a2f5cd5d01451512bdb75d726e61e419fa | Medium | Score 53/100 | First seen |
| SHA256 | ccfc37014ce6183bb9268e15e8569fc870e3ccc1123fc2fac9cf43862369f335 | Medium | Score 53/100 | First seen |
| SHA256 | c6a0476571cf67255001201be70f6fdfc3ac945515c1c8b327a9a92a4e89991d | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…