Exploring 'TheWizards' Use of SLAAC Spoofing for Targeted Attacks

May 6, 2025 · 4 min read · Summary CRIL came across a blog published by ESET detailing an investigation into a threat actor named TheWizards, a group aligned with China. TheWizards employs a tool known as Spellbinder for adversary-in-the-middle (AitM) attacks. The attacks expl...