Threat Actors Use New RingH23 Arsenal to Compromise MacCMS and CDN Infrastructure at Scale

XLab reports that the Funnull criminal group (previously OFAC-sanctioned) resurfaced with a sophisticated server-side toolkit named RingH23, compromising CDN management and poisoning the maccms.la update channel to deploy backdoors, an Nginx module, and a rootkit; telemetry shows at least 10,748 infected IPs and an estimated exposure of over one million users per day, with detailed TTPs, IoCs, and remediation advice provided.