- Chinese threat actor Thewizards observed to run a slaac attack since 2022
- The attack supplies painted software updates
- Most victims are in China, Hong Kong, Philippines and UAE
A threat actor called Thewizards has run Slaac forfilling attacks to target organizations, Cyber Security Scientists Eset has revealed, claiming the group is in line with the Chinese government.
In the campaign, the striker would use a tool called Spellbinder to send Fake Router Advertacing (RA) messages to their goals.
These messages fool devices into believing that the striker’s system is the legitimate router that makes them route all their internet traffic through the hacker’s machine. As this method manipulates the stateless address Autoconfiguration (Slaac) process, the entire attack was called “Slaac Spoofing”.
Active at the time of press
When Wizards start controlling traffic, they use spelling ties to intercept DNS queries for legitimate software updates and redirect them.
As a result, the victims end up downloading Trojanized versions of software updates containing the Wizardnet stopper door.
This piece of malware, ESET, explained further, gives Wizard’s remote access to the victim units. It communicates over encrypted TCP or UDP plugs and uses a sessionkey based on system identifiers for AES encryptions.
In addition to loading and execution of .NET modules in memory, Wizardnet can extract system data, list running processes and maintain persistence.
The campaign has been underway since at least 2022, Eset added mainly targeted at people and businesses in China, Hong Kong, Cambodia, the Philippines and the UAE.
Apparently, Crooks is currently fooling people to download a fake Tencent update: “The malicious server issuing the update instructions was still active at the time of writing,” Eset said. Most of the business victims seem to be in vertical.
Eset also said that Spellbinder is monitoring domains that belong not only to Tencent, but also Baidu, Xunlei, Youku, Iqiyi, Kingsoft, Mango TV, Funshion, Yuodao, Xiaomi, Xiaomi Miui, Pplive, Meitu, Quihoo 360 and Baofeng.
The best way to mitigate the risk is to monitor IPV6 traffic or turn off the protocol if not required in the environment, the ESET concluded.
Via Bleeping computer
