Funnull Resurfaces: Exposing RingH23 Arsenal and MacCMS Supply Chain Attacks
The report details the resurgence of the Funnull cybercriminal group, now utilizing a new arsenal called RingH23. It exposes their tactics, including compromising GoEdge CDN nodes, poisoning the MacCMS supply chain, and deploying sophisticated malware components like Badredis2s, Badnginx2s, and Badhide2s. The group has expanded its operations to inject malicious JavaScript, hijack cryptocurrency transactions, and redirect traffic to fraudulent sites. The campaign's impact is estimated to affect millions of users daily. The report also highlights Funnull's use of a suspicious new CDN infrastructure, CDN1.AI, likely created to evade detection.
Pulse ID: 69a5cb4a6a4e3817035f5326
Pulse Link: https://otx.alienvault.com/pulse/69a5cb4a6a4e3817035f5326
Pulse Author: AlienVault
Created: 2026-03-02 17:39:22
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#CDN #CyberSecurity #Edge #ICS #InfoSec #Java #JavaScript #Mac #Malware #Nginx #OTX #OpenThreatExchange #RAT #Redis #SupplyChain #bot #cryptocurrency #AlienVault








