Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

TheWizards, a China-aligned threat actor, employs Spellbinder, a lateral movement tool that enables adversary-in-the-middle attacks through IPv6 SLAAC spoofing. This technique allows the group to intercept network traffic and redirect legitimate Chinese software updates to malicious servers. The attackers deploy their custom backdoor, WizardNet, which can load additional modules and gather system information. TheWizards targets individuals, gambling companies, and other entities in several Asian countries and the UAE. The group is linked to Sichuan Dianke Network Security Technology Co., Ltd. (UPSEC), known for supplying malware to other threat actors. TheWizards' sophisticated toolset and tactics demonstrate their advanced capabilities in compromising networks and evading detection.

TheWizards is a China-aligned advanced persistent threat (APT) group that has developed and deployed a sophisticated lateral movement toolset centered around IPv6 SLAAC (Stateless Address Autoconfiguration) spoofing to conduct adversary-in-the-middle (AiTM) attacks. Their tool, Spellbinder, manipulates the IPv6 network environment by spoofing SLAAC messages, allowing the attackers to intercept and redirect network traffic within compromised environments. This technique enables TheWizards to hijack legitimate network communications, notably redirecting software update requests from Chinese software vendors to attacker-controlled malicious servers. By doing so, they can deliver their custom backdoor, WizardNet, which is capable of loading additional malicious modules and performing extensive system reconnaissance. WizardNet facilitates persistent access and lateral movement within targeted networks. The group’s targets include individuals and gambling companies primarily in Asia and the UAE, indicating a strategic focus on high-value commercial and personal data in these regions. TheWizards are linked to Sichuan Dianke Network Security Technology Co., Ltd. (UPSEC), a known malware supplier, underscoring their access to advanced malware development resources. Their use of IPv6 SLAAC spoofing is notable because it exploits a relatively less monitored network protocol, allowing stealthy interception of traffic and evasion of traditional detection mechanisms. The attack chain involves network-level manipulation without requiring user interaction, increasing the risk of undetected compromise. TheWizards’ tactics, techniques, and procedures (TTPs) include software update hijacking, process injection, credential dumping, and use of custom malware modules, demonstrating a high level of operational sophistication and adaptability.

Detailed information about TheWizards APT group uses SLAAC spoofing to perform adversary-in-the-middle attacks. Get real-time updates, technical details, and mi

TheWizards APT group uses SLAAC spoofing to perform adversary-in-the-middle attacks - Live Threat Intelligence - Threat Radar | OffSeq.com

TheWizards APT group uses SLAAC spoofing to perform adversary-in-the-middle attacks

TheWizards, a China-aligned APT group, employs Spellbinder, a lateral movement tool for adversary-in-the-middle attacks through IPv6 SLAAC spoofing. This technique allows them to intercept network traffic and redirect legitimate Chinese software updates to malicious servers. The group targets individuals, gambling companies, and entities in Southeast Asia, UAE, China, and Hong Kong. Their malware chain includes the WizardNet backdoor and utilizes DNS hijacking to deliver malicious updates. Evidence links TheWizards to Sichuan Dianke Network Security Technology Co., Ltd. (UPSEC), suggesting it may be a digital quartermaster for this APT group. The attackers use sophisticated tools and techniques to evade detection and maintain persistence on compromised systems.

TheWizards is a China-aligned advanced persistent threat (APT) group that has been observed employing a sophisticated attack technique involving IPv6 SLAAC (Stateless Address Autoconfiguration) spoofing to conduct adversary-in-the-middle (AiTM) attacks. Their toolset includes Spellbinder, which facilitates lateral movement within compromised networks by exploiting IPv6 network configuration protocols. By spoofing SLAAC messages, TheWizards can manipulate network traffic flows, intercepting and redirecting legitimate software update requests—specifically targeting Chinese software updates—to malicious servers under their control. This redirection enables the delivery of malicious payloads disguised as legitimate updates, thereby compromising targeted systems without raising immediate suspicion. The malware chain used by TheWizards includes the WizardNet backdoor, which provides persistent remote access and control over infected hosts. Additionally, the group leverages DNS hijacking techniques to further ensure the delivery of malicious updates and maintain control over network communications. The campaign targets individuals and organizations primarily in Southeast Asia, the UAE, China, and Hong Kong, with a focus on gambling companies among other entities. Attribution evidence links TheWizards to Sichuan Dianke Network Security Technology Co., Ltd. (UPSEC), suggesting a possible front or digital quartermaster role supporting the group’s operations. The attackers demonstrate advanced operational security and evasion capabilities, making detection and mitigation challenging. This attack vector is notable for exploiting IPv6 network protocols, which are increasingly deployed but often less monitored than IPv4, thereby expanding the attack surface for lateral movement and network traffic interception.

Title	Severity	Type	Source	Date

Threats Tagged 'software update hijacking'

Filter Threats

Threats Tagged 'software update hijacking'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility