FUNNULL

THREAT ACTOR PROFILE

FUNNULL

Triad Nexus

FUNNULL is a China-linked malicious content delivery network, tracked alongside the Triad Nexus cybercrime operation, that provides infrastructure for large-scale fraud and supply-chain abuse. It is best known for the Polyfill.io supply-chain attack and for hosting pig-butchering and brand-impersonation scams, and it has worked to launder and rebuild its infrastructure after US sanctions.

Country:

Not attributed

Malicious infrastructure / Fraud

First seen

2023

Latest IOC

IP indicators

Hosts

SHA256 hashes

Posts

IP indicators

Hosts

SHA256 hashes

Posts

TABLE OF CONTENTS

Names and aliases

Group profile

Attack lifecycle

Malware and tooling

IOCs

Notable campaigns

NAMES AND ALIASES

FUNNULL, Fangneng CDN and Triad Nexus

FUNNULL is tracked under several names tied to its infrastructure and operators. It maps to one entry among the malicious infrastructure operators we track, and its China-linked fraud-infrastructure role overlaps with cybercrime operations like Smishing Triad.

GROUP PROFILE

A CDN built for fraud and supply-chain abuse

FUNNULL is infrastructure-as-a-service for cybercrime. Rather than running a single malware family, it supplies the hosting, domains and delivery that power fraud operations and malicious JavaScript campaigns at scale.

Our record ties it to malicious CDN activity and the Triad Nexus fraud operation, linked to more than 200 million dollars in pig-butchering losses. After the US sanctioned FUNNULL in 2025, the operators shifted toward infrastructure laundering and front companies.

The group's tradecraft includes the Polyfill.io supply-chain attack, trojanized packages, the RingH23 toolkit for CDN-node compromise and traffic hijacking, and rotating CNAMEs and ASNs to evade tracking.

Facts:

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Victims reported in our records and posts:

ATTACK LIFECYCLE

Infrastructure abuse into fraud and redirection

The stages below come from FUNNULL and Triad Nexus activity in posts we track on our IOC Hunter feed.

Initial Access

Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.

Initial Access

MALWARE AND TOOLING

RingH23 and the traffic-hijacking components

Initial Access

CVES EXPLOITED

Infrastructure and supply-chain abuse over CVE exploitation

FUNNULL operates through domain and CDN control, trojanized packages and supply-chain abuse rather than a consistent set of exploited software vulnerabilities. One flaw associated with its Polyfill supply-chain activity in our records is CVE-2024-38526 (polyfill supply-chain risk). Detection should focus on the malicious CDN domains, trojanized packages, the RingH23 toolkit and rotating CNAME and ASN infrastructure.

RECENT {{name}} IOCS

Latest IOCs

We currently track - IP indicators, - hosts, and - SHA256 hashes for Akira across - intelligence posts, with the most recent indicator dated -. The sample below is limited to indicators from the latest posts. It is not the full set.

Showing a sample of recent indicators

Get the complete 8Base IOC set, full IP, host and hash history.

Unlock all the IOCs for Free

Showing a sample of recent indicators

Get the complete 8Base IOC set, full IP, host and hash history.

Unlock all the IOCs for Free

NOTABLE CAMPAIGNS

Polyfill, RingH23 and post-sanction persistence

Recent reporting tracks the group's infrastructure and evasion.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

Track {{name}} across campaigns, IOCs and infrastructure

This page shows a sample of recent indicators and recent campaigns. Sign up free to pivot through

Track {{name}} across campaigns, IOCs and infrastructure

This page shows a sample of recent indicators and recent campaigns. Sign up free to pivot through