TheWizards APT group uses SLAAC spoofing to perform adversary-in-the-middle attacks

TheWizards, a China-aligned threat actor, employs Spellbinder, a lateral movement tool that enables adversary-in-the-middle attacks through IPv6 SLAAC spoofing. This technique allows the group to intercept network traffic and redirect legitimate Chinese software updates to malicious servers. The attackers deploy their custom backdoor, WizardNet, which can load additional modules and gather system information. TheWizards targets individuals, gambling companies, and other entities in several Asian countries and the UAE. The group is linked to Sichuan Dianke Network Security Technology Co., Ltd. (UPSEC), known for supplying malware to other threat actors. TheWizards' sophisticated toolset and tactics demonstrate their advanced capabilities in compromising networks and evading detection.

• M365 Token Spray and Replay Campaign Compromises Business Email AccountsCampaign2026-10-22
• The Tale of Two INC Ransom Notes: A Ransomware TimelineMalware2026-09-21
• ValleyRAT is spreading disguised as adwareMalware2026-08-31
• Mirage2FA Hijacks Companies’ Microsoft 365 Sessions, with Over 4K Victims in the USCampaign2026-08-18
• Jewelbug: APT Group Runs Espionage and Crypto Fraud Operations Side by SideMalware2026-08-13