A China-linked threat group dubbed “TheWizards” has been exploiting an IPv6 networking vulnerability to conduct adversary-in-the-middle (AitM) attacks since at least 2022. According to security researchers at ESET, the group targets organizations across the Philippines, Cambodia, UAE, China, and Hong Kong, focusing on gambling companies and various other entities.

## The Spellbinder Attack Method

The attackers utilize a custom tool called “Spellbinder” that exploits the IPv6 Stateless Address Autoconfiguration (SLAAC) feature. This technique, known as a SLACC attack, works by:

1. Sending spoofed Router Advertisement (RA) messages across the network
2. Forcing nearby systems to automatically configure new IPv6 addresses, DNS servers, and gateways
3. Setting the attacker’s IP address as the preferred gateway
4. Intercepting and rerouting traffic through attacker-controlled servers

“Spellbinder sends a multicast RA packet every 200 ms to all nodes on the network,” ESET explains. “Windows machines with IPv6 enabled will autoconfigure using information in the RA message and begin sending IPv6 traffic to the machine running Spellbinder.”

## Infection Chain and Payload

The attack begins with an archive named AVGApplicationFrameHostS.zip that extracts to a directory mimicking legitimate AVG software. The package contains:
– AVGApplicationFrameHost.exe
– wsc.dll (malicious)
– log.dat
– winpcap.exe (legitimate)

The legitimate WinPcap executable side-loads the malicious wsc.dll, which then loads Spellbinder into memory. Once active, Spellbinder monitors network traffic for connections to specific domains, particularly Chinese software update servers from companies like Tencent, Baidu, Xiaomi, and Kingsoft.

When users attempt to update software from these sources, Spellbinder redirects the requests to download malicious updates containing a backdoor called “WizardNet.” This backdoor provides persistent access to infected devices and allows attackers to deploy additional malware.

## Protection Measures

Organizations can protect themselves by:
– Monitoring IPv6 traffic for suspicious activity
– Disabling IPv6 if not required in their environment
– Implementing network segmentation
– Using trusted update sources over secure connections

This attack follows a similar pattern to another campaign reported by ESET in January, where a group called “Blackwood” hijacked WPS Office software updates to install malware.