TheWizards APT Casts a Spell on Asian Gamblers With Novel Attack

ESET research presented at RSAC 2025 attributes a campaign to a Chinese APT called TheWizards that uses a tool named Spellbinder to perform IPv6 SLAAC spoofing (AitM) to intercept and hijack software update processes for popular Chinese applications, delivering a DLL downloader that leads to the WizardNet modular backdoor; the activity targets gambling companies and customers across multiple countries and shows tooling overlap with Earth Minotaur (including DarkNimbus/DarkNights for Android).