TheWizards APT group uses SLAAC spoofing to perform adversary-in-the-middle attacks

ESET researchers detail TheWizards, a China-aligned APT active since at least 2022, which uses a custom IPv6 SLAAC adversary‑in‑the‑middle tool named Spellbinder to hijack legitimate Chinese software updates and deliver a modular backdoor called WizardNet; the report includes technical analysis, execution chains, victim geography, IoCs (files and network), MITRE mappings, and links to infrastructure and a suspected supplier (UPSEC).