Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
80 IOCs
Funnull Resurfaces: Exposing RingH23 Arsenal and MacCMS Supply Chain Attacks
Threat Actors
Malware Families
Excerpt
Background Funnull (Funnull Technology Inc.), also known as Fangneng CDN, is a Philippines-registered company that publicly claims to provide CDN services. In reality, it has long operated as a key infrastructure provider for Southeast Asia’s cybercriminal ecosystem, offering one-stop services for large-scale “pig-butchering” scam operations. It has been formally designated by the U.S. government as a major cybercrime enabler and is widely referred to in…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(6)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →80 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | goyppg06.com | High | Score 63/100 | First seen |
| MD5 | 296318b90bc9d01ab045da042b0ecb21 | High | Score 56/100 | First seen |
| MD5 | fef497841554fff318b740dff7df3a49 | High | Score 56/100 | First seen |
| MD5 | b8239ce64c07e39ae7bed9ae8f5f3d2f | High | Score 56/100 | First seen |
| Domain | jsdelivr.vip | High | Score 63/100 | First seen |
| MD5 | 65ac2839ab2790b6df8e80022982a2c0 | High | Score 56/100 | First seen |
| MD5 | 663706d4f3948417d05c11bbfa6cdbc9 | High | Score 56/100 | First seen |
| MD5 | da594309691161f6e999984c26e1a10f | High | Score 56/100 | First seen |
| MD5 | d3b0b6496747ee77ab15e5f5d9583a67 | High | Score 56/100 | First seen |
| Domain | js.mirrors163.com | High | Score 63/100 | First seen |
| Domain | cn.js.mirrors163.com | High | Score 63/100 | First seen |
| MD5 | ae0de7034c4866556675740f6647bfcc | High | Score 56/100 | First seen |
| MD5 | 5f34cd492c5af9f56f3c38e72320cc49 | Medium | Score 53/100 | First seen |
| Domain | fedoraforums.net | High | Score 63/100 | First seen |
| MD5 | 85cdf5139f0a0a0f7e378bc2029d662b | High | Score 56/100 | First seen |
| Domain | bytedauce.com | High | Score 63/100 | First seen |
| MD5 | 51830656b0825b22703e4fcf31aec84c | High | Score 56/100 | First seen |
| Domain | a.plusedns.com | High | Score 63/100 | First seen |
| MD5 | b5a5d93cfc443ecbd3b52cfe485b738c | High | Score 56/100 | First seen |
| Domain | mirrors163.com | High | Score 63/100 | First seen |
| Domain | sbindns.com | High | Score 63/100 | First seen |
| SHA1 | 7d1d49a8d8c1fa7b4b743ed551fa338c112268e1 | High | Score 56/100 | First seen |
| Domain | lucycally.me | High | Score 63/100 | First seen |
| Domain | cdn.jsdclivr.com | High | Score 64/100 | First seen |
| MD5 | 563f5e605ebf1db8065fd41799e71bf9 | High | Score 56/100 | First seen |
| Domain | maccmsp.la | High | Score 58/100 | First seen |
| MD5 | 2e7a42c9be6fc3840df867cb19c7afa5 | High | Score 56/100 | First seen |
| Domain | client.110.nz | High | Score 63/100 | First seen |
| Domain | ntp.asia | High | Score 63/100 | First seen |
| Domain | s11.ntporg.com | High | Score 63/100 | First seen |
| Domain | bdustatic.com | High | Score 63/100 | First seen |
| Domain | macoms.la | High | Score 63/100 | First seen |
| MD5 | b06b9f13505eb49d6b3f4bddd64b12ce | High | Score 56/100 | First seen |
| Domain | apk.aqyaqua.com | High | Score 63/100 | First seen |
| Domain | debianhacks.net | High | Score 63/100 | First seen |
| Domain | realfake909.net | High | Score 63/100 | First seen |
| MD5 | eb03db7ac9f10af66a1e2b16185fcadc | High | Score 56/100 | First seen |
| Domain | service.client.110.nz | High | Score 58/100 | First seen |
| MD5 | b5dfe88131fb1b3622a487df96be84e1 | High | Score 56/100 | First seen |
| Domain | zybbzlast.com | High | Score 63/100 | First seen |
| Domain | ntporg.com | High | Score 63/100 | First seen |
| Domain | maccms.la | High | Score 58/100 | First seen |
| Domain | b.plusedns.com | High | Score 63/100 | First seen |
| Domain | js.ntporg.com | High | Score 63/100 | First seen |
| MD5 | 946606977dd177347122867750244ae2 | High | Score 56/100 | First seen |
| Domain | ubuntucommands.com | High | Score 63/100 | First seen |
| Domain | js.ntp.asia | High | Score 63/100 | First seen |
| MD5 | 3bff298be46f8817862bce2ac0be3176 | High | Score 56/100 | First seen |
| Domain | jquecy.com | High | Score 64/100 | First seen |
| Domain | 9688hopeeasy.cc | High | Score 63/100 | First seen |
| MD5 | 79c492bfd8a35039249bacc6a31d7122 | High | Score 56/100 | First seen |
| MD5 | 18b699375c76328b433145bdac02ec49 | High | Score 56/100 | First seen |
| MD5 | 5d6c33bf931699805206b00594de5e71 | High | Score 56/100 | First seen |
| Domain | tutupytua.com | High | Score 63/100 | First seen |
| Domain | firelategg.net | High | Score 63/100 | First seen |
| Domain | s10.ntporg.com | High | Score 63/100 | First seen |
| Domain | linuxdistro.net | High | Score 63/100 | First seen |
| Domain | bobolickp92.cc | High | Score 63/100 | First seen |
| Domain | plusedns.com | High | Score 63/100 | First seen |
| MD5 | 112e2eb2a57129ef175c3f64bccbac04 | High | Score 56/100 | First seen |
| URL | https://cdnjs.clondflare.com/jquery.min-3.7.8.1.js | High | Score 63/100 | First seen |
| Domain | moxymodiy.cc | High | Score 63/100 | First seen |
| MD5 | dfd1fbf0a98e0984da9516311ccc1f05 | High | Score 56/100 | First seen |
| Domain | update.ntporg.com | High | Score 63/100 | First seen |
| MD5 | 92c630062f0fe207c628b95fade34b96 | High | Score 56/100 | First seen |
| MD5 | 22f0d58bc482d413a5cc8922c7f79378 | High | Score 56/100 | First seen |
| MD5 | 6e14853a6ad5e752a516290bf586d700 | High | Score 56/100 | First seen |
| Domain | clondflare.com | High | Score 63/100 | First seen |
| MD5 | a688afd342cee9feb74c61503fb0b895 | High | Score 56/100 | First seen |
| Domain | jsdclivr.com | High | Score 64/100 | First seen |
| Domain | gadlkd1.com | High | Score 63/100 | First seen |
| MD5 | 6acb8bbcad3b8403f4567412cc6aa144 | High | Score 56/100 | First seen |
| Domain | mobileconfig.aqyaqua.com | High | Score 63/100 | First seen |
| Domain | flysky55.me | High | Score 63/100 | First seen |
| MD5 | cd36ec10f71b89dc259eb8825e668ae3 | High | Score 56/100 | First seen |
| MD5 | 85f3d29a8fd59e00fec83743664fb2b5 | High | Score 56/100 | First seen |
| Domain | ailyun-oss.com | High | Score 63/100 | First seen |
| Domain | js.sbindns.com | High | Score 63/100 | First seen |
| Domain | ailyunoss.com | High | Score 63/100 | First seen |
| Domain | js2.ntporg.com | High | Score 63/100 | First seen |
IOC Relationship Graph
Building graph…