Funnull CDN Poisoning and Sub-Store Zero-Day Campaign

A complex supply-chain and watering hole campaign attributed to the Funnull threat group has been identified exploiting a zero-day vulnerability in Sub-Store, a popular proxy subscription manager. By poisoning widely used JavaScript libraries on CDNs like BootCSS, BootCDN, and Staticfile, attackers gained unauthenticated remote code execution on visitors' local machines running affected proxy applications. The campaign specifically targeted Chinese proxy ecosystem users but affected any visitor to compromised storefronts like SpeedyBee.

The technical execution involved multi-platform delivery: Windows and macOS users received the ProRAM implant via DLL sideloading and local privilege escalation; Linux users were targeted with the RingH23 Rinit malware; and iPhone users were routed through sophisticated exploit chains. Notably, the campaign utilized the Coruna exploit kit for iOS 13-17 and the DarkSword chain (exploiting several zero-days including CVE-2025-43529 and CVE-2026-20700) for iOS 18.4-18.7.2. The final iOS payloads included the PLASMAGRID manager and GHOSTBLADE-derived implants for extensive data exfiltration.

This incident highlights the critical risk of browser-to-localhost communication and the fragility of third-party CDN dependencies. Organizations should prioritize updating Sub-Store to version 2.38.2 and implement Subresource Integrity (SRI) for all external scripts. The business impact includes full system compromise across desktop and mobile platforms, with a focus on credential theft, session hijacking, and cryptocurrency wallet exfiltration.