Hackers abuse IPv6 networking feature to hijack software updates

ESET attributes a campaign since at least 2022 to a China-aligned APT dubbed "TheWizards" that uses a tool called Spellbinder to spoof IPv6 SLAAC Router Advertisements, force Windows hosts to adopt an attacker-controlled IPv6 gateway, intercept update traffic for numerous Chinese software vendors, and serve malicious updates that install a persistent WizardNet backdoor; infections are staged via a trojanized archive (AVGApplicationFrameHostS.zip) and DLL side-loading with WinPcap. Mitigations include monitoring or disabling IPv6 where not required and watching for the listed file and network indicators.