TheWizards
TheWizards is a China-attributed nation-state APT group with an espionage motive, tracked by Brandefense. It targets organisations in 4 countries, including China and the Philippines.
- Origin
- China
- Techniques
- 0
- Exploited CVEs
- No CVE data
- First seen
- Jan 1, 2022
- Record updated
Who They Target.
About TheWizards.
TheWizards is a China-aligned APT group that employs the Spellbinder tool for adversary-in-the-middle attacks, utilizing IPv6 SLAAC spoofing to redirect legitimate software updates to malicious servers. They have developed the WizardNet backdoor for Windows and serve DarkNights to Android applications, indicating a connection to Dianke Network Security Technology. The group targets individuals and companies in the Philippines, Cambodia, the UAE, mainland China, and Hong Kong.
Last updated Oct 9, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.