Loading threat actor…
Funnull, also known as Funnull Technology Inc. and Fangneng CDN, is a Philippines-registered cybercriminal infrastructure provider linked to large-scale online fraud and malicious traffic-redirection operations. U.S. authorities sanctioned the organization in May 2025, identifying it as a major enabler of virtual-currency investment and romance-baiting scams and associating its infrastructure with hundreds of thousands of domains and substantial victim losses. Reporting also identifies a Chinese national, Liu Lizhi, as the group’s administrator. The group presents itself as a content delivery network provider but has been tied to scam-hosting infrastructure, supply-chain abuse, and server-side compromise operations. Funnull has been associated with infrastructure supporting Southeast Asia’s cybercriminal ecosystem, especially fraud operations commonly described as pig-butchering. It has also been linked to a supply-chain attack involving the Polyfill.io JavaScript library and to malicious redirect infrastructure used to send victims to gambling and adult-content destinations. Funnull’s more recent activity has been attributed to a modular framework referred to as RingH23. This toolkit has been described as compromising CDN management and edge nodes, propagating over SSH, deploying downloader and backdoor components, establishing persistence through system configuration abuse, and using stealth mechanisms including a userland rootkit. Reported components include an encrypted WebSocket backdoor with cloud-hosted configuration retrieval and DNS-tunneling fallback, as well as a malicious Nginx module used for JavaScript injection, traffic hijacking, and cryptocurrency wallet-address substitution. The group has also been linked to poisoning the update channel of a MacCMS distribution to deliver PHP backdoors that inject malicious JavaScript into downstream websites. Observed tradecraft includes supply-chain compromise, infrastructure poisoning, malicious JavaScript injection, mobile-user redirection, anti-analysis checks, selective victim gating, credential theft support through spoofed financial platforms, large-scale scam enablement, and defense evasion through short-lived payload delivery and stealth tooling. Funnull is best characterized as a financially motivated cybercriminal actor and infrastructure operator rather than a traditional espionage group.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
15 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
5 malware families attributed to this actor across reporting.
17 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malicious infrastructure provider/CDN whose infrastructure is used as second-stage payload hosting and redirect infrastructure in a software supply-chain campaign (trojanized JS in PHP Composer themes). The FUNNULL-linked chain performs mobile-only, time-gated, anti-analysis checks and redirects victims to gambling/adult content; infrastructure remains actively maintained post-OFAC sanctions.
Cybercriminal infrastructure/operator enabling and conducting large-scale malicious CDN and CMS supply-chain style compromises. Reported activity includes compromising GoEdge CDN management nodes to push payloads via SSH to edge nodes, poisoning the maccms.la update channel to deliver a PHP backdoor, and using the RingH23 framework to inject malicious JavaScript redirects, perform crypto wallet address replacement, and maintain stealth/persistence via a userland rootkit and DNS-tunneling fallback C2.
Cybercriminal infrastructure provider and active operator behind large-scale supply-chain and CDN/CMS poisoning used to hijack web traffic (malicious JavaScript injection/redirects), support pig-butchering scam ecosystems, and run a Linux server-side compromise framework (RingH23) that implants a modular backdoor/rootkit/Nginx module stack on CDN edge nodes for persistent control and monetization (gambling/porn redirects, wallet replacement, download hijacking).
Operated a content delivery network supporting China-based gambling, money laundering, and large-scale investment/romance scams ('pig butchering').
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.