Badredis2s

Badredis2s is a modular, plugin-based backdoor Trojan identified as the backdoor component of the RingH23 server-side compromise framework attributed in the reporting to the Funnull cybercriminal group, also known as Fangneng CDN. It is also referenced by the filenames ring04h_office_bin and office_bin. The malware targets Linux server environments compromised through RingH23 infection chains, including attacks in which a GoEdge CDN management node is first compromised and used to push payloads to downstream edge nodes over SSH, as well as campaigns linked to poisoned MacCMS update infrastructure that deploy related server-side malware. Badredis2s provides long-term remote access over AES-128-CBC encrypted WebSocket tunnels and is described as dynamically retrieving primary C2 addresses from Microsoft Azure Blob Storage. If primary connectivity is blocked, it falls back to DNS tunneling using the open-source iodine tool; reporting also states it uses WSS-over-TLS first and can use a hardcoded backup C2. Reported Badredis2s-associated C2 domains include linuxdistro[.]net, debianhacks[.]net, fedoraforums[.]net, ubuntucommands[.]com, ntp[.]asia, ntporg[.]com, sbindns[.]com, and plusedns[.]com. In the broader RingH23 campaign, Badredis2s operated alongside other Linux components including infect_init, download_init, the Badnginx2s malicious Nginx module, and the Badhide2s LD_PRELOAD userland rootkit. The overall activity was reported to affect CDN infrastructure and large numbers of streaming/movie-related sites, enabling malicious JavaScript injection, traffic redirection to gambling and pornographic sites, and cryptocurrency wallet address swapping.