WizardNet
WizardNet is a modular Windows backdoor first publicly disclosed by ESET in April 2025 and associated with the China-aligned threat actor TheWizards. It is delivered via the Spellbinder adversary-in-the-middle framework, which abuses IPv6 Stateless Address Autoconfiguration spoofing and ICMPv6 Router Advertisements to position the attacker as the victim’s gateway, intercept DNS queries, and hijack legitimate software update traffic. ESET observed this delivery chain against Chinese software update mechanisms including Tencent QQ and previously Sogou Pinyin. In the observed infection flow, attackers deploy a ZIP archive containing AVGApplicationFrameHost.exe, wsc.dll, log.dat, and winpcap.exe; the legitimate AVG component is abused for DLL sideloading, wsc.dll reads shellcode from log.dat, and the shellcode loads Spellbinder in memory. Spellbinder then redirects targeted update traffic to attacker-controlled infrastructure, causing victims to download a malicious DLL or archive that retrieves an encrypted blob whose loader executes WizardNet in memory.
WizardNet is described as a modular implant that connects to a remote controller to receive and execute .NET modules on the compromised machine. The loader attempts defense evasion by patching AmsiScanBuffer to bypass AMSI and patching EtwEventWrite to disable ETW logging. It initializes the .NET runtime, decrypts the payload, and runs WizardNet in memory. WizardNet creates a mutex named Global\<MD5(computer_name)>, derives a SessionKey from MD5(computer name + install time + disk serial), stores it under HKCU\Software<MD5(computer_name)><MD5(computer_name)>mid, and communicates over TCP or UDP using AES-ECB with PKCS7 padding. It can read shellcode from ppxml.db or registry key HKCU\000000 and attempts to inject shellcode into explorer.exe or %ProgramFiles%\Windows Photo Viewer\ImagingDevices.exe.
ESET telemetry indicates targeting of individuals, gambling companies, and other entities in the Philippines, Cambodia, the United Arab Emirates, mainland China, Hong Kong, and elsewhere. Infrastructure mentioned in the reporting includes 43.155.116[.]7 and 43.155.62[.]54 for malicious update delivery and 43.135.35[.]84 (mkdmcdn[.]com) for WizardNet C2. Additional reporting noted infrastructure overlap between WizardNet and Cisco Talos’ DKnife framework, including host 43.132.205[.]118 hosting WizardNet on port 8881, and similar update-hijacking URL patterns shared with Spellbinder-linked activity. Trend Micro also reported ties between HOLODONUT and WizardNet, and linked WizardNet usage to TheWizards. ClamAV detection names referenced in the content include Win.Loader.WizardNet-10044819-0.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
“The downloader then acts as a conduit to drop a modular backdoor codenamed WizardNet.”
"...code artifacts, and targeting patterns align with previously documented campaigns involving ShadowPad, DarkNimbus, and the WizardNet backdoor."
Techniques & procedures
21 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
3 techniques
Resource Development
Initial Access
2 techniques
Initial Access
Execution
2 techniques
Execution
Persistence
1 technique
Persistence
Privilege Escalation
2 techniques
Privilege Escalation
Stealth
6 techniques
Stealth
“The downloader and shellcode… dynamically resolve API addresses.”
“The shellcode obtained by the downloader contains WizardNet in encrypted form.”
“WizardNet… attempts to inject [shellcode] into a new process of explorer.exe or %ProgramFiles%\Windows Photo Viewer\ImagingDevices.exe.”
“WizardNet uses the QueueUserApc API to execute injected code.”
Defense Impairment
1 technique
Defense Impairment
Credential Access
1 technique
Credential Access
Discovery
3 techniques
Discovery
Collection
1 technique
Collection
Command and Control
4 techniques
Command and Control
“Depending on its configuration, WizardNet can then create a TCP or UDP socket to communicate with its C&C server…”
"...redirecting the traffic of legitimate Chinese software so that it downloads malicious updates from a server controlled by the attackers"
IOCs tracked for this family
5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Backdoor referenced as linked to the DKnife toolchain/campaign; specific capabilities not described in the provided content.
Malware/tooling linked by shared infrastructure and similar update-hijacking tradecraft to DKnife; previously associated (in this content) with campaigns impacting the Philippines, Cambodia, and the UAE.
Backdoor/framework mentioned as overlapping in infrastructure/TTPs with DKnife activity and used in related regional operations.
Modular backdoor referenced as delivered in AitM-style campaigns; linked in the text to tooling lineage shared with other AitM frameworks.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.