TheWizards Deploy ‘Spellbinder Hacking Tool’ for Global Adversary-in-the-Middle Attack

**ESET discovered a China-aligned APT dubbed “TheWizards” that uses an IPv6 SLAAC spoofing tool called Spellbinder to conduct adversary-in-the-middle attacks and hijack legitimate software updates (notably Tencent QQ) to distribute modular backdoors (WizardNet for Windows and DarkNights for Android), targeting organizations across Asia and the Middle East since 2022 and accompanied by multiple IoCs.**