Skip to content
Threat Actors Use New RingH23 Arsenal to Compromise MacCMS and CDN Infrastructure at Scale

Threat Actors Use New RingH23 Arsenal to Compromise MacCMS and CDN Infrastructure at Scale

Cybersecuritynews •Tushar Subhra Dutta • March 5, 2026

A cybercriminal group known as Funnull — previously sanctioned by the U.S. Treasury — has returned with a dangerous new toolkit called RingH23, silently compromising CDN nodes and poisoning the MacCMS content management system to redirect millions of users to illegal websites. The campaign marks a significant escalation in Funnull’s capabilities, moving beyond simply hijacking […]

Extracted Entities

Malware (1)

RingH23

Platforms (1)

MacCMS