MalwarePublished 2 Mar 2026Updated 1 Apr 2026

Funnull Resurfaces: Exposing RingH23 Arsenal and MacCMS Supply Chain Attacks

Source AlienVault OTX General

Description

The report details the resurgence of the Funnull cybercriminal group, now utilizing a new arsenal called RingH23. It exposes their tactics, including compromising GoEdge CDN nodes, poisoning the MacCMS supply chain, and deploying sophisticated malware components like Badredis2s, Badnginx2s, and Badhide2s. The group has expanded its operations to inject malicious JavaScript, hijack cryptocurrency transactions, and redirect traffic to fraudulent sites. The campaign's impact is estimated to affect millions of users daily. The report also highlights Funnull's use of a suspicious new CDN infrastructure, CDN1.AI, likely created to evade detection.

Impact

The Funnull campaign’s impact is multifaceted and severe for organizations worldwide. By compromising the MacCMS supply chain and GoEdge CDN nodes, attackers can distribute malware and malicious scripts at scale, affecting millions of users daily. This undermines trust in software supply chains and content delivery networks, potentially leading to widespread data breaches, credential theft, and unauthorized access. The injection of malicious JavaScript and traffic redirection can result in significant financial losses through cryptocurrency theft and fraud. Organizations relying on MacCMS for content management or GoEdge CDN for content delivery face increased risk of service disruption, reputational damage, and regulatory consequences due to compromised user data. The use of a custom CDN infrastructure (CDN1.AI) complicates detection and response efforts, allowing attackers to maintain persistence and evade traditional security controls. Overall, the threat can degrade confidentiality, integrity, and availability of affected systems and services, with a broad scope due to the supply chain and CDN poisoning vectors.

Defensive guidance

To mitigate the Funnull threat, organizations should implement a multi-layered approach focused on supply chain security and CDN integrity. Specifically, they should: 1) Conduct thorough security assessments and code audits of MacCMS components and any third-party plugins or updates before deployment. 2) Monitor and validate the integrity of CDN nodes and content delivery paths, including GoEdge and any newly introduced CDNs like CDN1.AI, using cryptographic verification and anomaly detection. 3) Employ strict network segmentation and access controls to limit exposure of critical infrastructure to external services. 4) Implement runtime application self-protection (RASP) and web application firewalls (WAF) to detect and block malicious JavaScript injections and traffic redirection attempts. 5) Monitor for indicators of compromise related to Badredis2s, Badnginx2s, and Badhide2s malware families, including unusual Redis or Nginx activity and hidden processes. 6) Enforce multi-factor authentication and credential hygiene to reduce the risk of credential theft and misuse. 7) Establish incident response plans that include supply chain compromise scenarios and regularly update threat intelligence feeds to detect emerging tactics. 8) Collaborate with CDN providers and software vendors to ensure timely patching and transparency in supply chain security. These measures, combined with user education on phishing and social engineering risks, will help reduce the attack surface and improve detection and response capabilities.

Indicators of compromise

Domains 57

9688hopeeasy.cc
ailyun-oss.com
ailyunoss.com
aqyaqua.com
bdustatic.com
bytedauce.com
clondflare.com
debianhacks.net
fedoraforums.net
firelategg.net

URLs 23

http://api.bdustatic.com/jquery.min-4.0.12.js
http://cdn.jsdelivr.vip/jquery.min-3.7.0.js
http://cdnjs.jsdclivr.com/npm/bootstrap@5.3.0/dist/css/bootstrap.min.css?v=3.7.8.2
http://code.jquecy.com/jquery.min-3.6.8.js
http://static.bytedauce.com/ajax/libs/bootstrap/5.3.3/css/bootstrap-grid.min.css
http://union.macoms.la/jquery.min-4.0.2.js
https://3snzh72om4.apifox.cn
https://az-blob.110.nz/update/init
https://az-blob.110.nz/update/s1
https://az-blob.110.nz/update/s2

IP addresses 1

8.139.6.156

Hashes 64

112e2eb2a57129ef175c3f64bccbac04
18b699375c76328b433145bdac02ec49
22f0d58bc482d413a5cc8922c7f79378
296318b90bc9d01ab045da042b0ecb21
2e7a42c9be6fc3840df867cb19c7afa5
3bff298be46f8817862bce2ac0be3176
51830656b0825b22703e4fcf31aec84c
563f5e605ebf1db8065fd41799e71bf9
5d6c33bf931699805206b00594de5e71
5f34cd492c5af9f56f3c38e72320cc49

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 3 Mar 2026, 17:33 UTC

MITRE ATT&CK techniques19 from threat tags

Technical details