Tag: spellbinder

1 Attack Reports | 0 Vulnerabilities

Attack reports

TheWizards APT group uses SLAAC spoofing to perform adversary-in-the-middle attacks

TheWizards, a China-aligned threat actor, employs Spellbinder, a lateral movement tool that enables adversary-in-the-middle attacks through IPv6 SLAAC spoofing. This technique allows the group to intercept network traffic and redirect legitimate Chinese software updates to malicious servers. The at…

lateral movement

adversary-in-the-middle

software update hijacking

Published: May 9, 2025

Downloadable IOCs: 8

Click here to see more Attack Reports