Skip to main content
Press slash or control plus K to focus the search. Use the arrow keys to navigate results and press enter to open a threat.
Reconnecting to live updates…

Funnull Resurfaces: Exposing RingH23 Arsenal and MacCMS Supply Chain Attacks

0
Medium
Published: Mon Mar 02 2026 (03/02/2026, 17:39:22 UTC)
Source: AlienVault OTX General

Description

The report details the resurgence of the Funnull cybercriminal group, now utilizing a new arsenal called RingH23. It exposes their tactics, including compromising GoEdge CDN nodes, poisoning the MacCMS supply chain, and deploying sophisticated malware components like Badredis2s, Badnginx2s, and Badhide2s. The group has expanded its operations to inject malicious JavaScript, hijack cryptocurrency transactions, and redirect traffic to fraudulent sites. The campaign's impact is estimated to affect millions of users daily. The report also highlights Funnull's use of a suspicious new CDN infrastructure, CDN1.AI, likely created to evade detection.

AI-Powered Analysis

AILast updated: 03/03/2026, 17:33:37 UTC

Technical Analysis

The Funnull threat actor group has re-emerged with a new set of tools and tactics collectively referred to as the RingH23 arsenal. This campaign notably targets the MacCMS content management system supply chain and GoEdge CDN nodes, employing supply chain poisoning and CDN poisoning techniques to propagate malware and malicious scripts. The malware components Badredis2s, Badnginx2s, and Badhide2s are used to facilitate various malicious activities, including injecting JavaScript into web traffic, hijacking cryptocurrency transactions, and redirecting users to fraudulent websites. The group’s use of a newly established CDN infrastructure, CDN1.AI, suggests an attempt to evade detection and maintain persistence. The attack chain involves multiple MITRE ATT&CK techniques such as T1133 (External Remote Services), T1578 (Supply Chain Compromise), T1608.004 (Malware), T1140 (Deobfuscate/Decode Files or Information), and others related to credential access, persistence, and defense evasion. Although no active exploits have been reported in the wild, the campaign’s scale—potentially affecting millions daily—indicates a high-impact threat with a broad attack surface. The supply chain attack vector is particularly concerning as it can bypass traditional perimeter defenses, enabling widespread distribution of malicious payloads through trusted software updates or CDN content delivery. The campaign’s focus on cryptocurrency theft and traffic hijacking also highlights financial motivations and risks for affected users and organizations.

Potential Impact

The Funnull campaign’s impact is multifaceted and severe for organizations worldwide. By compromising the MacCMS supply chain and GoEdge CDN nodes, attackers can distribute malware and malicious scripts at scale, affecting millions of users daily. This undermines trust in software supply chains and content delivery networks, potentially leading to widespread data breaches, credential theft, and unauthorized access. The injection of malicious JavaScript and traffic redirection can result in significant financial losses through cryptocurrency theft and fraud. Organizations relying on MacCMS for content management or GoEdge CDN for content delivery face increased risk of service disruption, reputational damage, and regulatory consequences due to compromised user data. The use of a custom CDN infrastructure (CDN1.AI) complicates detection and response efforts, allowing attackers to maintain persistence and evade traditional security controls. Overall, the threat can degrade confidentiality, integrity, and availability of affected systems and services, with a broad scope due to the supply chain and CDN poisoning vectors.

Mitigation Recommendations

To mitigate the Funnull threat, organizations should implement a multi-layered approach focused on supply chain security and CDN integrity. Specifically, they should: 1) Conduct thorough security assessments and code audits of MacCMS components and any third-party plugins or updates before deployment. 2) Monitor and validate the integrity of CDN nodes and content delivery paths, including GoEdge and any newly introduced CDNs like CDN1.AI, using cryptographic verification and anomaly detection. 3) Employ strict network segmentation and access controls to limit exposure of critical infrastructure to external services. 4) Implement runtime application self-protection (RASP) and web application firewalls (WAF) to detect and block malicious JavaScript injections and traffic redirection attempts. 5) Monitor for indicators of compromise related to Badredis2s, Badnginx2s, and Badhide2s malware families, including unusual Redis or Nginx activity and hidden processes. 6) Enforce multi-factor authentication and credential hygiene to reduce the risk of credential theft and misuse. 7) Establish incident response plans that include supply chain compromise scenarios and regularly update threat intelligence feeds to detect emerging tactics. 8) Collaborate with CDN providers and software vendors to ensure timely patching and transparency in supply chain security. These measures, combined with user education on phishing and social engineering risks, will help reduce the attack surface and improve detection and response capabilities.

Need more detailed analysis?Upgrade to Pro Console

Technical Details

Author
AlienVault
Tlp
white
References
["https://blog.xlab.qianxin.com/funnull-resurfaces-exposing-ringh23-arsenal-and-maccms-supply-chain-attacks/"]
Adversary
Funnull
Pulse Id
69a5cb4a6a4e3817035f5326
Threat Score
null

Indicators of Compromise

Hash

ValueDescriptionCopy
hash112e2eb2a57129ef175c3f64bccbac04
hash18b699375c76328b433145bdac02ec49
hash22f0d58bc482d413a5cc8922c7f79378
hash296318b90bc9d01ab045da042b0ecb21
hash2e7a42c9be6fc3840df867cb19c7afa5
hash3bff298be46f8817862bce2ac0be3176
hash51830656b0825b22703e4fcf31aec84c
hash563f5e605ebf1db8065fd41799e71bf9
hash5d6c33bf931699805206b00594de5e71
hash5f34cd492c5af9f56f3c38e72320cc49
hash65ac2839ab2790b6df8e80022982a2c0
hash663706d4f3948417d05c11bbfa6cdbc9
hash6acb8bbcad3b8403f4567412cc6aa144
hash6e14853a6ad5e752a516290bf586d700
hash79c492bfd8a35039249bacc6a31d7122
hash85cdf5139f0a0a0f7e378bc2029d662b
hash85f3d29a8fd59e00fec83743664fb2b5
hash92c630062f0fe207c628b95fade34b96
hash946606977dd177347122867750244ae2
hasha688afd342cee9feb74c61503fb0b895
hashae0de7034c4866556675740f6647bfcc
hashb06b9f13505eb49d6b3f4bddd64b12ce
hashb5a5d93cfc443ecbd3b52cfe485b738c
hashb5dfe88131fb1b3622a487df96be84e1
hashb8239ce64c07e39ae7bed9ae8f5f3d2f
hashcd36ec10f71b89dc259eb8825e668ae3
hashd3b0b6496747ee77ab15e5f5d9583a67
hashda594309691161f6e999984c26e1a10f
hashdfd1fbf0a98e0984da9516311ccc1f05
hasheb03db7ac9f10af66a1e2b16185fcadc
hashfef497841554fff318b740dff7df3a49
hash0100bd14f6ace04cd6687fbaf3c308690af94362
hash152fbaae6a1a4525868583e0caad23d2e9ecbcb7
hash1b87e14ad5b7f825f28e092a277e67baf79cec1f
hash1c9303a558593153361dacb2e69cdfe90d5d5c43
hash3b208b0a411b8e97be2d9239abf87a3905e0b46e
hash40217756653636176e55720b6ec7cc351b5e99de
hash54cf891fbdebecff2ed28ccbc72f701445c14e37
hash5d33149d9846eab781340347c418ab4610cbdb58
hash63803c1c5915107154b10edf333b522aa47440d8
hash7d1d49a8d8c1fa7b4b743ed551fa338c112268e1
hash8a4e6bc2c424564488a0a7199677f5c2fdcb4d94
hasha5cc1e1c59d9d058e9e7aa2b555b10ee5f2162f9
hashc4157764a5d62ed35e7035a2506624a65ce54c79
hashc61d90a0c0dd9e9bc7162bada4f8762ad4806b5d
hashd0108b40685f3ac12bec23290291789484d1de50
hashe8f46e141c74341abdeec7edf0fed9a35f8c06ce
hashf423420e320eb29d43cd675e59fd3636a1bec758
hash077d6aed18d71c5fc08cbd2a52f963178189cdcedae21a2cf812560e3355c40a
hash09b0503f6eee217e5b9c41773b8b22a90e640f2f7c5a44adc48c5b70b50a4137
hash27cb410b59e83b3f5274a6d80e0a572d0ef85a7a5d3606815ed71c1271be1123
hash30340b0a9b7ee100909cb7fc8a0d65bdc249cecea5c078f464a17b3022104e62
hash43427b5742bfcc51c9382e6fe64b74a0148188010ef80de36359951e49d172a6
hash44810a9c726690e38abeca7edc62325317ce4e7b8c8fff3401a3180d184d8767
hash4d71e92ca46e3f3fa74ebee8f4cab5d0ef214d63d1df880d5a17db94ac101dfb
hash568e137a510520acf7c84e151ded90803f83fe5561e29348caa8ae7c8514e96d
hash6da988eddf7e7be66c42e54bf781b554bbb81bf16767c47b617f634c48442aa4
hash75e1366c54d9803e97c69234f31d7d1d0a0a1165fef9bd72f9fe8aa13955c11c
hasha324e95450eaa5e23fcdb66c056a4ef7c80a521da75751a0fb4c3cc542de0d4d
hasha61ab901f3644db457fa87852a9f69890f42b0bfa263415ddecde04b8c569617
hasha95b17ba5a419451b66e13e93baa1f7281d127cd8039ff20143df681dfb9cb0c
hashb49e03c9c759bbe8b45fe8bfa6b953fc381f5c8aa1dc56de1ae006815c0831a8
hashbda1f5ceff6c4ec9ab2a9fd661f0c5e0113e418cab9a4358bd3e9926de13737a
hashe829040cac2fbccdffe23024b9f8c64af77037f941b010d4727c2c292bbc3665

Ip

ValueDescriptionCopy
ip8.139.6.156

Url

ValueDescriptionCopy
urlhttp://api.bdustatic.com/jquery.min-4.0.12.js
urlhttp://cdn.jsdelivr.vip/jquery.min-3.7.0.js
urlhttp://cdnjs.jsdclivr.com/npm/bootstrap@5.3.0/dist/css/bootstrap.min.css?v=3.7.8.2
urlhttp://code.jquecy.com/jquery.min-3.6.8.js
urlhttp://static.bytedauce.com/ajax/libs/bootstrap/5.3.3/css/bootstrap-grid.min.css
urlhttp://union.macoms.la/jquery.min-4.0.2.js
urlhttps://3snzh72om4.apifox.cn
urlhttps://az-blob.110.nz/update/init
urlhttps://az-blob.110.nz/update/s1
urlhttps://az-blob.110.nz/update/s2
urlhttps://az-blob.110.nz/update/s3
urlhttps://az-blob.110.nz/update/s4
urlhttps://az-blob.110.nz/update/s7
urlhttps://az-blob.110.nz/update/s9
urlhttps://bucket.service.generate.110.nz/2025-12-19/7d1d49a8d8c1fa7b4b743ed551fa338c112268e1/kernel.so
urlhttps://bucket.service.generate.110.nz/2025-12-19/7d1d49a8d8c1fa7b4b743ed551fa338c112268e1/module.so
urlhttps://bucket.service.generate.110.nz/2025-12-19/7d1d49a8d8c1fa7b4b743ed551fa338c112268e1/udev.rules
urlhttps://bucket.service.generate.110.nz/udev.sh
urlhttps://cdnjs.clondflare.com/jquery.min-3.7.8.1.js
urlhttps://cdnjs.jsdclivr.com/npm/bootstrap@5.3.0/dist/css/bootstrap.min.css?v=3.7.8.2
urlhttps://download.joymeet.top/app/2PG/00056321.mobileconfig
urlhttps://dowoxox.gfewr.com/B9.apk
urlhttps://plist.ztyfv.com/d/4F48MCiqtsjDCS7QOWs3KU.plist

Domain

ValueDescriptionCopy
domain9688hopeeasy.cc
domainailyun-oss.com
domainailyunoss.com
domainaqyaqua.com
domainbdustatic.com
domainbytedauce.com
domainclondflare.com
domaindebianhacks.net
domainfedoraforums.net
domainfirelategg.net
domainflysky55.me
domaingadlkd1.com
domaingoyppg06.com
domainjsdclivr.com
domainjsdelivr.vip
domainlinuxdistro.net
domainlucycally.me
domainmaccmsp.la
domainmoxymodiy.cc
domainrealfake909.net
domaintutupytua.com
domainubuntucommands.com
domainzybbzlast.com
domain3snzh72om4.apifox.cn
domaina.plusedns.com
domainapi.bdustatic.com
domainapk.aqyaqua.com
domainaz-blob.110.nz
domainb.plusedns.com
domainbucket.service.generate.110.nz
domaincdn.jsdclivr.com
domaincdn.jsdelivr.vip
domaincdnjs.clondflare.com
domaincdnjs.jsdclivr.com
domainclient.110.nz
domaincn.js.mirrors163.com
domaincode.jquecy.com
domaindownload.joymeet.top
domaindowoxox.gfewr.com
domainh2.debianhacks.net
domainj6.linuxdistro.net
domainjs.mirrors163.com
domainjs.ntp.asia
domainjs.ntporg.com
domainjs.sbindns.com
domainjs2.ntporg.com
domainmobileconfig.aqyaqua.com
domainnsj6.linuxdistro.net
domainplist.ztyfv.com
domains.aqyaqua.com
domains10.ntporg.com
domains11.ntporg.com
domainservice.client.110.nz
domainstatic.bytedauce.com
domainunion.macoms.la
domainupdate.maccms.la
domainupdate.ntporg.com

Threat ID: 69a717a5d1a09e29cb601e3e

Added to database: 3/3/2026, 5:17:25 PM

Last enriched: 3/3/2026, 5:33:37 PM

Last updated: 3/4/2026, 7:20:15 AM

Views: 11

Community Reviews

0 reviews

Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Sort by
Loading community insights…

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Actions

PRO

Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.

Please log in to the Console to use AI analysis features.

External Links

Need more coverage?

Upgrade to Pro Console in Console -> Billing for AI refresh and higher limits.

For incident response and remediation, OffSeq services can help resolve threats faster.

Latest Threats

Breach by OffSeqOFFSEQFRIENDS — 25% OFF

Check if your credentials are on the dark web

Instant breach scanning across billions of leaked records. Free tier available.

Scan now
OffSeq TrainingCredly Certified

Lead Pen Test Professional

Technical5-day eLearningPECB Accredited
View courses