A cybercriminal group known as Funnull — previously sanctioned by the U.S. Treasury — has returned with a dangerous new toolkit called RingH23, silently compromising CDN nodes and poisoning the MacCMS content management system to redirect millions of users to illegal websites.
The campaign marks a significant escalation in Funnull’s capabilities, moving beyond simply hijacking legitimate CDN services to building and deploying a fully self-owned, server-side attack framework.
Funnull, also known as Fangneng CDN, is a Philippines-registered company that publicly claims to offer CDN services, but has long served as a core infrastructure provider for Southeast Asia’s cybercriminal ecosystem.
The group facilitated large-scale “pig-butchering” scams and fraudulent investment platforms, with victim losses reported to exceed $200 million.
On May 29, 2025, the U.S. Treasury’s Office of Foreign Assets Control (OFAC) formally sanctioned the group, temporarily stalling its operations.
Cybercriminal supply chains, however, are remarkably resilient — and Funnull proved this by quietly rebuilding under a new identity.
XLab’s analysts identified the resurgence on July 9, 2025, when their Cyber Threat Insight and Analysis System (CTIA) detected a suspicious ELF binary being distributed from the domain download.zhw[.]sh — a file registering zero detections on VirusTotal.
The embedded domain client.110[.]nz showed an astonishing 1.6 billion DNS resolutions in XLab’s Passive DNS system, a clear signal that researchers were not looking at an isolated incident but something far larger.
This discovery triggered an active threat-hunting investigation that would eventually expose one of the most sophisticated criminal CDN operations seen in recent years.
Funnull pursued two separate infection routes. In the first, attackers compromised a GoEdge CDN management node and used an infection module to issue SSH remote commands, forcing all connected edge nodes to download and execute the RingH23 toolkit.
In the second path, the group poisoned the official update channel of maccms.la — a widely adopted open-source video CMS with over 2,700 GitHub stars — to deliver a malicious PHP backdoor.
Upon the administrator’s first login after installation, the payload was silently fetched and activated. The download link remained valid for only three minutes and automatically expired afterward, deliberately frustrating any forensic retrieval.
The scale of impact is staggering. XLab’s telemetry identified over 10,748 infected IP addresses, most belonging to streaming and movie-related websites.
One typosquatted domain impersonating Cloudflare — cdnjs.clondflare[.]com — recorded 340,000 unique client visits in a single day at its peak on August 30, 2025.
Since XLab’s monitoring covers only about 5% of the domestic market, researchers conservatively estimate that over one million users per day were exposed to malicious JavaScript redirecting them toward gambling and adult websites.
Inside the RingH23 Arsenal: Modular Design Built for Total Control
The RingH23 toolkit is a carefully engineered, multi-component framework with clear separation of responsibilities across each stage of the attack chain — a hallmark of professional black-market development, not opportunistic hacking.
.webp)
The entry point is infect_init, a Golang-based infector packed with UPX that requires root privileges and validates session tokens and group keys against a C2 server before proceeding.
.webp)
After authentication, it queries the GoEdge management database to harvest edge node credentials and then deploys the next stage — download_init — across every connected server via SSH.
download_init acts as the staging engine (Figure 2: download_init payload deployment chain). It probes the compromised system’s Nginx configuration, registers with the C2 server, and retrieves download URLs for all remaining payloads — including the backdoor, rootkit, malicious Nginx module, and udev persistence rules.
The most technically advanced component is the Badredis2s backdoor (ring04h_office_bin), which communicates over AES-128-CBC encrypted WebSocket tunnels, with C2 addresses dynamically fetched from Microsoft Azure Blob Storage.
If the primary connection is blocked, it automatically falls back to DNS tunneling using the open-source iodine tool, ensuring persistent C2 access regardless of firewall restrictions.
Alongside it, the Badnginx2s Nginx module intercepts outbound traffic to inject malicious JavaScript, silently replace Ethereum and TRON wallet addresses with attacker-controlled ones, and insert 5-second video segments into HLS streaming playlists.
The Badhide2s userland rootkit completes the picture by writing itself into /etc/ld.so.preload to conceal all malicious files, processes, and network connections from common tools like ps, ls, and netstat. Defenders can immediately disable this rootkit by setting the environment variable RING04H={hash}, which reveals all hidden components instantly.
XLab strongly recommends that website operators stop using maccms.la, audit server files using grep xxSJRox and grep gzuncompress to detect template injection and hidden PHP payloads, and remove active.php from the application directory to break the persistent reinfection cycle.
Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.
