ESET Research
ESET Research analyzes tools from the China-aligned TheWizards group, with targets across Asia and the Middle East
ESET researchers have analyzed Spellbinder, a lateral movement tool used to perform adversary-in-the-middle attacks by the China-aligned threat actor TheWizards. Spellbinder enables adversary-in-the-middle attacks through IPv6 stateless address autoconfiguration spoofing, which allows the attackers to redirect the update protocols of legitimate Chinese software to malicious servers. Then the legitimate software is tricked into downloading and executing the malicious components that launch the backdoor WizardNet.
TheWizards has been constantly active since at least 2022 until the present and, according to ESET telemetry, targets individuals, gambling companies, and unknown entities in the Philippines, Cambodia, the United Arab Emirates, mainland China, and Hong Kong.
“We initially discovered and analyzed this tool in 2022, and observed a new version with a few changes that was deployed to compromised machines in 2023 and 2024,” says ESET researcher Facundo Muñoz, who analyzed Spellbinder and WizardNet. “Our research led us to discover a tool used by the attackers that is designed to perform adversary-in-the-middle attacks using IPv6 SLAAC spoofing to intercept and reply to packets in a network, allowing the attackers to redirect traffic and serve malicious updates to legitimate Chinese software,” explains Muñoz.
The final payload in the attack is a backdoor that we named WizardNet – a modular implant that connects to a remote controller to receive and execute .NET modules on the compromised machine. ESET researchers have focused on one of the latest cases, in 2024, in which the update of Tencent QQ software was hijacked. The malicious server that issues the update instructions is still active. This variant of WizardNet supports five commands, three of which allow it to execute .NET modules in memory, thus extending its functionality on the compromised system.
TheWizards and the Chinese company Dianke Network Security Technology (also known as UPSEC) – supplier of the DarkNights backdoor (also known as DarkNimbus), appear to be linked. According to NCSC UK, this malicious backdoor also has Tibetan and Uyghur communities among its primary targets. While TheWizards uses a different backdoor – the WizardNet, the hijacking server is configured to serve DarkNights to updating applications running on Android devices.
The post ESET Research analyzes tools from the China-aligned TheWizards group, with targets across Asia and the Middle East appeared first on Gaming and Gambling Industry in the Americas.
-
Asia4 weeks ago
Jetapult Strengthens AI Expertise: Onboards Industry Leaders, Oz Silahtar and Dr. Arjun Jain
-
Africa3 weeks ago
Association of Gaming Operators in Kenya Announces New Regulations
-
Conferences in Europe4 weeks ago
Altenar Steps in as General Sponsor of EEGS 2025
-
Press Releases3 weeks ago
Swintt stacks up a pyramid of wins in Egypt King Pearl Upgrade
-
Press Releases4 weeks ago
Colour the world your way in Supa Crew by Swintt’s Elysium Studios
-
Compliance Updates3 weeks ago
MGCB Targets 11 Illegal Online Casinos Operating Without Licenses
-
Cancún4 weeks ago
CONCEPT AND NEW GAMES REVOLUTIONIZE PALACE BINGO & SPORTS BETS IN CANCÚN
-
Africa4 weeks ago
Readen Holding Corp Finalises Acquisition of Morrich Lottery Limited