{
  "name": "Triad Nexus: FUNNULL CDN hosting DGA domains for suspect Chinese sites",
  "slug": "triad-nexus-funnull-cdn-hosting-dga-domains-for-suspect-chinese-sites",
  "description": "Silent Push has uncovered a large-scale malicious infrastructure dubbed 'Triad Nexus' hosted on the FUNNULL content delivery network. The investigation revealed over 200,000 unique hostnames, with 95% created using Domain Generation Algorithms. FUNNULL is linked to hosting suspect gambling websites, investment scams, and a retail phishing campaign targeting major brands. Connections were found to the Suncity Group, previously implicated in money laundering for the Lazarus crime group. A supply chain attack involving the polyfill.io JavaScript library affected over 110,000 websites. The research exposes FUNNULL's role in facilitating various criminal activities and raises concerns about its practices as a CDN provider.",
  "published": "2024-10-23T11:19:41+00:00",
  "created_at": "2024-10-23T11:19:41+00:00",
  "modified_at": "2024-10-23T11:51:01+00:00",
  "created_at_opencti": "2024-10-23T11:19:41+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2024-10-23",
    "cdn",
    "dga",
    "funnull",
    "gambling",
    "phishing",
    "suncity group",
    "supply chain attack",
    "triad nexus"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "www.cmegrouphkpd.info"
      },
      {
        "id": "",
        "name": "vk6a2rmn-u.funnull01.vip"
      },
      {
        "id": "",
        "name": "vk6a2rmn-u.funnull.vip"
      },
      {
        "id": "",
        "name": "tiffa.tiffyfy.net"
      },
      {
        "id": "",
        "name": "sonbuyue.comsonbuyue.net"
      },
      {
        "id": "",
        "name": "slvmgo.netslvmgo.com"
      },
      {
        "id": "",
        "name": "sakoffirg.comsakofforg.net"
      },
      {
        "id": "",
        "name": "marcus.marcudk.netmarcus.marcufu.net"
      },
      {
        "id": "",
        "name": "marcus.marcufu.net"
      },
      {
        "id": "",
        "name": "marcus.marcudk.net"
      },
      {
        "id": "",
        "name": "marcus.marcudk.com"
      },
      {
        "id": "",
        "name": "jdfraa.shopjdfroa.com"
      },
      {
        "id": "",
        "name": "inditetx.topinditetx.com"
      },
      {
        "id": "",
        "name": "h5.aldosop.com"
      },
      {
        "id": "",
        "name": "giltbl.comgiltql.com"
      },
      {
        "id": "",
        "name": "etsy.etsyshop1.com"
      },
      {
        "id": "",
        "name": "eby.ebayshos.comeby.ebanyshop.com"
      },
      {
        "id": "",
        "name": "eby.ebayshos.com"
      },
      {
        "id": "",
        "name": "eby.ebanyshop.com"
      },
      {
        "id": "",
        "name": "ebay.ebayshoo.com"
      },
      {
        "id": "",
        "name": "ebate.ebatshop.com"
      },
      {
        "id": "",
        "name": "coachbir.comcoachoig.com"
      },
      {
        "id": "",
        "name": "casher.cashewargi.com"
      },
      {
        "id": "",
        "name": "cartier.cartierate.com"
      },
      {
        "id": "",
        "name": "bonanza.jdfraa.com"
      },
      {
        "id": "",
        "name": "asda.assedda.comasda.assedaa.com"
      },
      {
        "id": "",
        "name": "asda.assedda.com"
      },
      {
        "id": "",
        "name": "asda.assedaa.com"
      },
      {
        "id": "",
        "name": "asda.aseasda.com"
      },
      {
        "id": "",
        "name": "aldosopy.comh5.aldosop.com"
      },
      {
        "id": "",
        "name": "aldo.shopaldo1.com"
      },
      {
        "id": "",
        "name": "6ce0a6db.u.fn03.vip"
      },
      {
        "id": "",
        "name": "12abb97f.u.fn03.vip"
      },
      {
        "id": "",
        "name": "valentinogtm.com"
      },
      {
        "id": "",
        "name": "t25556.com"
      },
      {
        "id": "",
        "name": "threevip.cc"
      },
      {
        "id": "",
        "name": "sonbuyue.net"
      },
      {
        "id": "",
        "name": "sonbuyue.com"
      },
      {
        "id": "",
        "name": "sonbuyre.com"
      },
      {
        "id": "",
        "name": "slvmgo.net"
      },
      {
        "id": "",
        "name": "slvmgo.com"
      },
      {
        "id": "",
        "name": "sakofforg.net"
      },
      {
        "id": "",
        "name": "sakoffirg.com"
      },
      {
        "id": "",
        "name": "sakoffhue.com"
      },
      {
        "id": "",
        "name": "s97988.com"
      },
      {
        "id": "",
        "name": "s3958.com"
      },
      {
        "id": "",
        "name": "r4113.com"
      },
      {
        "id": "",
        "name": "r0944.com"
      },
      {
        "id": "",
        "name": "milvmhshop.com"
      },
      {
        "id": "",
        "name": "lotasea.com"
      },
      {
        "id": "",
        "name": "k76697.com"
      },
      {
        "id": "",
        "name": "jdfroa.com"
      },
      {
        "id": "",
        "name": "inditetx.top"
      },
      {
        "id": "",
        "name": "jdfraa.shop"
      },
      {
        "id": "",
        "name": "inditetx.net"
      },
      {
        "id": "",
        "name": "hiflyk47344.top"
      },
      {
        "id": "",
        "name": "inditetx.com"
      },
      {
        "id": "",
        "name": "haodeac.com"
      },
      {
        "id": "",
        "name": "giltql.com"
      },
      {
        "id": "",
        "name": "giltql.net"
      },
      {
        "id": "",
        "name": "giltbl.com"
      },
      {
        "id": "",
        "name": "coachoph.com"
      },
      {
        "id": "",
        "name": "coachoig.com"
      },
      {
        "id": "",
        "name": "coachbir.com"
      },
      {
        "id": "",
        "name": "cjmall01.com"
      },
      {
        "id": "",
        "name": "bcbdsgs.com"
      },
      {
        "id": "",
        "name": "cmegrouphkpd.info"
      },
      {
        "id": "",
        "name": "aldosopy.com"
      },
      {
        "id": "",
        "name": "6289.com"
      },
      {
        "id": "",
        "name": "15991t.com"
      }
    ],
    "attack_patterns": [
      {
        "id": "28548897-8b18-4095-97e8-1732f52e9316",
        "name": "T1102.003"
      },
      {
        "id": "21fd9920-9bc7-4ba5-8cdd-3022c0ef4e9d",
        "name": "T1584.001"
      },
      {
        "id": "d19f56ca-5ce8-4bd1-af90-7d83e394470c",
        "name": "T1583.001"
      },
      {
        "id": "16e4fc82-7c0b-4d1a-b784-b804b4df26dc",
        "name": "T1204.001"
      },
      {
        "id": "9322d33b-00c1-4f99-9f1a-a33d93c0dac2",
        "name": "T1059.007"
      },
      {
        "id": "8598a502-2b24-4c8a-8ec3-45179f49e5b7",
        "name": "T1199"
      },
      {
        "id": "d9b45b3b-d093-4016-89e9-48f31ff4d05d",
        "name": "T1566"
      },
      {
        "id": "6c8f8a40-2746-4a37-86bd-81e82afa6e62",
        "name": "T1190"
      },
      {
        "id": "9f11a241-9abc-4c57-95dd-33955ab08826",
        "name": "T1078"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "China"
      },
      {
        "id": "",
        "name": "Retail"
      },
      {
        "id": "",
        "name": "Technology"
      },
      {
        "id": "",
        "name": "Finance"
      }
    ]
  },
  "external_refs": [
    "https://www.silentpush.com/blog/triad-nexus-funnull/",
    "https://otx.alienvault.com/pulse/6718f7eddcdb0477d000ddc9"
  ]
}