Loading malware…
RingH23 is a modular, server-side attack toolkit attributed in reporting to the cybercriminal group Funnull (aka Fangneng CDN), which was sanctioned by the U.S. Treasury (OFAC) on May 29, 2025. The toolkit is described as being used to silently compromise CDN infrastructure (including GoEdge management nodes and downstream edge nodes) and to poison the MacCMS (maccms.la) update channel to deploy malicious PHP backdoors, enabling large-scale malicious JavaScript injection and traffic redirection (notably to gambling/porn sites) with telemetry citing 10,748 infected IPs and an estimate of >1 million users/day exposed to redirects.
Infection routes described:
Modules/capabilities described:
Attribution/naming notes in the content:
Indicators explicitly mentioned in the content include:
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
...now they have evolved to independently develop complete server-side attack suites (RingH23), actively infiltrating CDN nodes...
4 distinct techniques documented for this family, organized by ATT&CK tactic.
"Funnull pursued two separate infection routes. In the first, attackers compromised a GoEdge CDN management node... forcing all connected edge nodes to download and execute the RingH23 toolkit. In the second path, the group poisoned the official update channel of maccms.la... to deliver a malicious PHP backdoor."
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A modular, multi-component server-side attack framework used to compromise CDN management/edge nodes and a CMS update channel, deploy multiple payloads (backdoor, rootkit, malicious Nginx module, persistence), and monetize via traffic redirection, crypto address replacement, and streaming playlist manipulation. Uses encrypted WebSocket C2 with fallback DNS tunneling.
Proprietary server-side attack suite used to compromise and control CDN nodes and deploy modules across edge infrastructure.
Proprietary server-side attack suite associated with FUNNULL infrastructure, used to infiltrate and control CDN nodes and deploy modules across edge nodes.
A modular Linux attack toolkit deployed across compromised CDN edge nodes. It uses a Go-based infector and downloader to deploy multiple payloads: Udev-based persistence, an Nginx malicious module for traffic hijacking/JS injection/crypto wallet replacement, a long-term backdoor with resilient C2 (Azure Blob + fallback) and WSS-first/DNS-tunnel fallback comms, and an LD_PRELOAD userland rootkit for concealment and module injection.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.