WizardNet
WizardNet is a modular Windows backdoor associated with the China-aligned threat actor TheWizards and delivered via adversary-in-the-middle software-update hijacking operations using the Spellbinder framework. ESET reported that Spellbinder abuses IPv6 SLAAC spoofing and forged ICMPv6 Router Advertisements to position the attacker as the default gateway, intercept DNS requests for targeted Chinese software domains, and redirect update traffic to attacker-controlled infrastructure. Observed delivery chains included abuse of Sogou Pinyin updates and, in 2024, hijacking Tencent QQ update traffic for update.browser.qq.com to serve a malicious archive that deployed a downloader and ultimately loaded WizardNet in memory.
The installation chain described by ESET used a ZIP archive containing AVGApplicationFrameHost.exe, wsc.dll, log.dat, and winpcap.exe. A legitimate AVG component was abused for DLL side-loading of wsc.dll, which read shellcode from log.dat and executed it in memory; the shellcode then loaded Spellbinder. The downloader later connected to an attacker-controlled server to retrieve an encrypted blob whose shellcode loaded WizardNet. The loader attempted defense evasion by patching AmsiScanBuffer to bypass AMSI and patching EtwEventWrite to disable ETW logging, then initialized the .NET runtime and executed WizardNet in memory.
WizardNet is described as a modular implant that connects to a remote controller to receive and execute .NET modules on the compromised machine. It creates a mutex named Global\<MD5(computer_name)>, derives a SessionKey from MD5(computer name + install time + disk serial), and stores data under HKCU\Software\<MD5(computer_name)>\<MD5(computer_name)>mid. It can read shellcode from ppxml.db or from registry key HKCU\000000 and attempts to inject that shellcode into explorer.exe or %ProgramFiles%\Windows Photo Viewer\ImagingDevices.exe. Communications use TCP or UDP with AES-ECB and PKCS7 padding keyed by the SessionKey.
Targeting reported for TheWizards includes individuals, gambling companies, and other entities in the Philippines, Cambodia, the United Arab Emirates, mainland China, and Hong Kong. Multiple reports also link WizardNet to broader China-nexus traffic-hijacking activity: Trend Micro assessed HOLODONUT is likely linked to WizardNet and TheWizards, and Cisco Talos found infrastructure overlap between WizardNet and the DKnife adversary-in-the-middle framework, which was used to hijack downloads and updates and was linked to activity in the Philippines, Cambodia, and the UAE. Reported infrastructure and indicators associated with WizardNet operations include 43.135.35.84 / mkdmcdn.com as WizardNet C2, and malicious update infrastructure including 43.155.116.7 and 43.155.62.54.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
“The downloader then acts as a conduit to drop a modular backdoor codenamed WizardNet.”
"...code artifacts, and targeting patterns align with previously documented campaigns involving ShadowPad, DarkNimbus, and the WizardNet backdoor."
Techniques & procedures
19 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
3 techniques“TheWizards has registered the domains hao[.]com, ssl-dns[.]com, and mkdmcdn[.]com.”
“TheWizards acquired servers for hosting tools, C&C, and to serve malicious updates.”
“TheWizards uses custom malware such as the WizardNet backdoor and Spellbinder.”
Initial Access
2 techniques"...hijacking the software update mechanism associated with Sogou Pinyin..."; "...hijack the software update process for Tencent QQ... to serve a trojanized version"
Execution
1 technique“WizardNet uses CreateProcessA to execute processes it injects shellcode into.”
Persistence
1 techniquePrivilege Escalation
2 techniquesStealth
5 techniques“The downloader and shellcode… dynamically resolve API addresses.”
“The shellcode obtained by the downloader contains WizardNet in encrypted form.”
“WizardNet… attempts to inject [shellcode] into a new process of explorer.exe or %ProgramFiles%\Windows Photo Viewer\ImagingDevices.exe.”
“WizardNet uses the QueueUserApc API to execute injected code.”
“During its initialization it creates a mutex named Global\<MD5(computer_name)>…”
Defense Impairment
1 techniqueDiscovery
3 techniques“Send information… machine name, OS name and architecture, time since system started… privileges… private IP address.”
“When obtaining a list of security solutions, it makes a list of running processes that match… 360tray… avp… mcshield… egui… rtvscan.”
Command and Control
4 techniques“Depending on its configuration, WizardNet can then create a TCP or UDP socket to communicate with its C&C server…”
"...redirecting the traffic of legitimate Chinese software so that it downloads malicious updates from a server controlled by the attackers"
“messages exchanged… encrypted with AES-ECB; the SessionKey is used as the key…”
Impact
1 technique"...intercepting the DNS query for the software update domain ... and issuing a DNS response with the IP address of an attacker-controlled server"
IOCs tracked for this family
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Recent activity
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Backdoor referenced as linked to the DKnife toolchain/campaign; specific capabilities not described in the provided content.
Malware/tooling linked by shared infrastructure and similar update-hijacking tradecraft to DKnife; previously associated (in this content) with campaigns impacting the Philippines, Cambodia, and the UAE.
Backdoor/framework mentioned as overlapping in infrastructure/TTPs with DKnife activity and used in related regional operations.
Modular backdoor referenced as delivered in AitM-style campaigns; linked in the text to tooling lineage shared with other AitM frameworks.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.