(Have feedback? Did something resonate with you? Did something annoy you? Just hit reply! :))

Get questions from your boss, like this:

1. what do you know about TheWizards threat actor?
2. What are the initial access vectors and infection chains used by TheWizards to deploy Spellbinder and WizardNet in targeted networks?
3. What are the initial access vectors and infection chains used by TheWizards to deploy Spellbinder and WizardNet in targeted networks?

Are you ready to level up your skillset? Get Started Here!

Suggested Pivot

What specific supply chain attack vectors does TheWizards exploit to deploy Spellbinder, such as compromised update servers or third-party software dependencies, and what telemetry or indicators (e.g., network, endpoint, registry) are most effective for early detection and mitigation?

TL;DR

Key Points

1. • TheWizards, a China-aligned APT, leverages IPv6 SLAAC spoofing for adversary-in-the-middle (AitM) attacks, hijacking software update mechanisms (notably Tencent QQ) to deploy custom malware.
   • Immediate deployment of IPv6 SLAAC spoofing detection and cryptographic validation of update channels is critical.
2. • Spellbinder and WizardNet, modular malware tools, enable persistent access, process injection, encrypted C2, and stealthy lateral movement.
   • Endpoint detection, registry monitoring, and threat hunting for obfuscated .NET modules and process injection are high-priority defenses.
3. • TheWizards’ TTPs include process injection (APC), registry modification, polymorphic code, and encrypted communications, mapped to MITRE ATT&CK techniques T1659, T1055, T1112, T1027, T1105, T1573.001, T1082, T1583.001/.004, T1587.001.
   • SOCs should implement Sigma rules for IPv6 SLAAC, suspicious .NET module execution, and APC-based process injection.
4. • The group’s operations target gambling, individuals, and other sectors in the Philippines, Cambodia, UAE, mainland China, and Hong Kong, with potential for global supply chain and cloud/mobile expansion.
   • Supply chain and cloud security teams must anticipate future targeting and harden defenses accordingly.
5. • No major public breaches are attributed yet, but recent technical disclosures (April–May 2025) highlight the sophistication and evolving threat.
   • Continuous threat intelligence integration and cross-industry sharing are essential for early warning and defense.

Executive Summary

TheWizards is a China-aligned APT group, active since at least 2022, specializing in espionage and influence operations across Asia and the Middle East. Their hallmark is the use of IPv6 SLAAC spoofing to hijack legitimate software update mechanisms—most notably Tencent QQ—enabling adversary-in-the-middle attacks that deliver custom malware (Spellbinder and WizardNet). Spellbinder exploits network packet manipulation and process injection, while WizardNet provides modular, encrypted backdoor capabilities for remote command execution, data exfiltration, and lateral movement.

The group’s TTPs include advanced evasion (polymorphic code, dynamic API resolution), process injection (APC), registry modification for persistence, and encrypted C2 channels. Their infrastructure leverages acquired domains and servers, with a focus on stealth and modularity. Technical detection is supported by Sigma rules targeting IPv6 SLAAC spoofing, suspicious .NET module execution, and process injection events.

Defensive recommendations include immediate deployment of IPv6 SLAAC spoofing detection (e.g., Suricata, Zeek), cryptographic validation of software updates, EDR tuning for process injection and obfuscated code, registry monitoring, and proactive threat hunting for lateral movement and encrypted communications. Threat intelligence teams should maintain updated feeds on TheWizards and related groups, while supply chain and cloud security teams must prepare for likely expansion into new sectors and platforms.

Short-term forecasts predict rapid adoption of IPv6-specific defenses and hardening of update mechanisms, while long-term trends suggest multi-platform malware evolution, sectoral/geographic expansion, and regulatory focus on supply chain security. TheWizards’ novel techniques are likely to be emulated by other APTs, underscoring the need for continuous monitoring, intelligence sharing, and adaptive defense strategies.

Attribution

Links and Similarity

Earth Minotaur:

• Shares some malware families (DarkNights/DarkNimbus) with TheWizards but operates with different infrastructure and targets.
• Similar malware usage and China alignment but different operational focus.

Historical Context

TheWizards is a China-aligned advanced persistent threat (APT) group first identified by ESET in 2022. The group has been active since at least that year, focusing on espionage and influence operations primarily in Asia and the Middle East. Their campaigns target individuals, gambling companies, and other entities in countries such as the Philippines, Cambodia, UAE, mainland China, and Hong Kong. TheWizards are distinguished by their use of sophisticated malware tools and novel lateral movement techniques, including IPv6 SLAAC spoofing to hijack legitimate software update mechanisms.

Timeline

• 2022: Emergence of TheWizards as a distinct APT group.
• 2022–2025: Ongoing operations targeting Asia and Middle East sectors.
• April 2025: Public disclosure and detailed technical analysis of TheWizards' malware tools Spellbinder and WizardNet by ESET and other cybersecurity researchers.

Origin

TheWizards are attributed to a China-aligned threat actor group with links to Sichuan Dianke Network Security Technology (UPSEC), a Chinese company supplying malware used in their campaigns. This connection suggests a commercial and state-aligned nexus supporting their operations.

Countries Targeted

1. Philippines – Focus on individuals and gambling companies.
2. Cambodia – Similar targeting as the Philippines.
3. United Arab Emirates (UAE) – Middle Eastern targets.
4. Mainland China – Internal espionage and control.
5. Hong Kong – Regional targeting consistent with other Asian operations.

Sectors Targeted

1. Gambling Companies – Primary sector targeted for espionage and financial intelligence.
2. Individuals – Likely for intelligence gathering.
3. Other Entities – Various sectors within targeted countries, possibly including government and private sectors.

Motivation

TheWizards are motivated by regional espionage and influence aligned with Chinese strategic interests. Their targeting suggests a blend of intelligence gathering and financial motives, with a focus on long-term access and control.

Attack Types

• Adversary-in-the-middle (AitM) attacks via IPv6 SLAAC spoofing.
• Hijacking of legitimate software update mechanisms.
• Deployment of modular backdoors and lateral movement tools.
• Use of process injection, obfuscation, and encrypted communication.

Technical Analysis

Malware: Spellbinder

Infection Chain

• Initial infection vectors are not fully disclosed but likely involve spear-phishing or supply chain compromise.
• Spellbinder is deployed as a ZIP archive containing executables, a .dat file, and a DLL.
• Upon execution, Spellbinder uses the WinPcap library to capture and manipulate network packets.
• It exploits IPv6 SLAAC spoofing to hijack Tencent QQ's software update process, redirecting update requests to attacker-controlled servers.

Persistence Mechanisms

• Spellbinder maintains persistence by hijacking legitimate software update channels, ensuring repeated execution during update cycles.
• It modifies registry keys to maintain execution and evade removal.
• The modular WizardNet backdoor is deployed via the hijacked update process, establishing long-term access.

Evasion Techniques

• Uses polymorphic code and dynamic API resolution to evade signature-based detection.
• Employs process injection, including asynchronous procedure calls, to hide malicious activity within legitimate processes.
• Obfuscates payloads and communications using encryption and non-standard protocols.
• Execution guardrails prevent detection by avoiding execution in sandbox or analysis environments.

Malware: WizardNet

Capabilities

• Modular .NET backdoor capable of executing various payloads.
• Supports remote command execution, data exfiltration, and lateral movement.
• Uses encrypted communication channels with symmetric cryptography.
• Employs process injection and registry modifications for stealth and persistence.

Deployment

• Delivered via Spellbinder's hijacked software update mechanism.
• Executes .NET modules dynamically, allowing flexible payload delivery.

Infrastructure

• Command and Control (C2) servers operate domains and servers acquired for malware deployment and control.
• Uses encrypted channels and non-application layer protocols for covert communication.
• Infrastructure supports modular malware delivery and lateral movement.

Tactics, Techniques, and Procedures (TTPs)

Prioritized MITRE ATT&CK techniques used by TheWizards include:

• T1583.001 Acquire Infrastructure: Domains
• T1583.004 Acquire Infrastructure: Servers
• T1587.001 Develop Capabilities: Malware
• T1659 Content Injection (used by Spellbinder)
• T1055 Process Injection (including asynchronous procedure calls)
• T1112 Modify Registry
• T1027 Obfuscated Files or Information (dynamic API resolution, embedded payloads, polymorphic code)
• T1082 System Information Discovery
• T1105 Ingress Tool Transfer
• T1573.001 Encrypted Channel: Symmetric Cryptography

Sigma-Format Detection Rules (Pseudocode Examples)

Rule 1: Detect IPv6 SLAAC Spoofing Activity

title: Detect IPv6 SLAAC Spoofing Attempts  
id: 12345678-90ab-cdef-1234-567890abcdef  
description: Detects suspicious IPv6 SLAAC traffic indicative of spoofing used by Spellbinder.  
status: experimental  
logsource:  
  product: network  
detection:  
  selection:  
    NetworkProtocol: ICMPv6  
    ICMPv6Type: 134  # Router Advertisement  
    SourceIPv6Address: suspicious or unexpected addresses  
  condition: selection  
fields:  
  - SourceIPv6Address  
level: high  

Rule 2: Detect Execution of Suspicious .NET Modules

title: Detect Suspicious .NET Module Execution  
id: 23456789-0abc-def1-2345-67890abcdef1  
description: Detects execution of .NET modules associated with WizardNet backdoor.  
status: experimental  
logsource:  
  product: windows  
  service: sysmon  
detection:  
  selection:  
    Image: '*\rundll32[.]exe'  
    CommandLine|contains: '.dat'  
  condition: selection  
fields:  
  - Image  
  - CommandLine  
level: high  

Rule 3: Detect Process Injection via Asynchronous Procedure Calls

title: Detect Process Injection via APC  
id: 34567890-abcd-ef12-3456-7890abcdef12  
description: Detects process injection using asynchronous procedure calls, a technique used by TheWizards.  
status: experimental  
logsource:  
  product: windows  
  service: sysmon  
detection:  
  selection:  
    EventID: 8  # CreateRemoteThread or similar  
    Details|contains: 'APC'  
  condition: selection  
fields:  
  - EventID  
  - Details  
level: high  

Recommendations, Actions, Suggested Pivots, Forecasts and Next Steps..

(Subscribers Only)