Full Report
Silent Push’s investigation into FUNNULL, a Chinese CDN, reveals its role in hosting extensive malicious infrastructure dubbed "Triad Nexus." This includes over 200,000 algorithmically generated domains connected to gambling, investment scams, phishing, and a supply chain atta...
Analysis Summary
# Threat Actor: FUNNULL Infrastructure / Triad Nexus
## Attribution & Identity
* **Actor Identification:** Associated with the infrastructure dubbed "Triad Nexus," hosted by the Chinese CDN, FUNNULL.
* **Known Aliases/Associations:** Infrastructure connected (via branding/laundering themes) to the **Suncity Group**, which is linked to money laundering operations for **North Korea's Lazarus Group**.
## Activity Summary
The discovered activity, "Triad Nexus," involves the use of FUNNULL to host extensive malicious infrastructure. This infrastructure includes over 200,000 algorithmically generated domains used for:
1. Gambling operations.
2. Investment scams.
3. Phishing campaigns.
4. A significant supply chain attack affecting over 110,000 websites via the `polyfill.io` library.
5. Money laundering networks promoted via GitHub and Telegram.
## Tactics, Techniques & Procedures
* **Initial Access:** Insider threat (mentioned generally in the context metadata).
* **Delivery/Exploitation:** Supply Chain Compromise (specifically targeting the `polyfill.io` library).
* **Interaction:** Phishing.
* **Post-Compromise Objective:** Money laundering, scamming.
## Targeting
* **Sectors:** Retail (major retail brands targeted by phishing); General web properties (impacted via supply chain compromise).
* **Geography:** Not explicitly detailed, but the infrastructure is hosted by a Chinese CDN (FUNNULL). Money laundering connections suggest global reach.
* **Victims:** Over 110,000 websites affected by the supply chain compromise. Major retail brands were targeted by phishing.
## Tools & Infrastructure
* **Malware Families Used:** Not explicitly named.
* **Infrastructure:**
* **Hosting Platform:** FUNNULL (a Chinese CDN).
* **Domains:** Over 200,000 algorithmically generated domains.
* **C2/Promotion:** GitHub, Telegram (used for promoting money laundering networks).
* **Compromised Library:** `polyfill.io` library used for supply chain vector.
## Implications
The operation represents a large-scale, multi-faceted criminal enterprise utilizing infrastructure control (via a CDN) to facilitate fraud, scams, and financial crime, with demonstrated capability to execute non-trivial supply chain attacks impacting a vast number of downstream users. The linkage to the Suncity Group and Lazarus Group suggests a potential nexus between organized cybercrime and state-sponsored illicit finance.
## Mitigations
* Scrutinize dependencies and third-party libraries, especially those integrated via CDNs or public scripts (e.g., monitoring changes to `polyfill.io` integrations).
* Enhance monitoring for domain generation algorithm (DGA) patterns across internal or customer-facing networks.
* Implement robust controls against evolving phishing tactics, particularly those related to investment and gambling scams.