ESET researchers have analyzed Spellbinder, a lateral movement tool used to perform adversary-in-the-middle attacks by the China-aligned threat actor TheWizards. Spellbinder enables adversary-in-the-middle attacks through IPv6 stateless address autoconfiguration spoofing, which allows the attackers to redirect the update protocols of legitimate Chinese software to malicious servers. Then the legitimate software is tricked into downloading and executing the malicious components that launch the backdoor WizardNet.

TheWizards has been constantly active since at least 2022 until the present and, according to ESET telemetry, targets individuals, gambling companies, and unknown entities in the Philippines, Cambodia, the United Arab Emirates, mainland China, and Hong Kong.

“We initially discovered and analyzed this tool in 2022, and observed a new version with a few changes that was deployed to compromised machines in 2023 and 2024,” says ESET researcher Facundo Muñoz, who analyzed Spellbinder and WizardNet. “Our research led us to discover a tool used by the attackers that is designed to perform adversary-in-the-middle attacks using IPv6 SLAAC spoofing to intercept and reply to packets in a network, allowing the attackers to redirect traffic and serve malicious updates to legitimate Chinese software,” explains Muñoz.

The final payload in the attack is a backdoor that we named WizardNet – a modular implant that connects to a remote controller to receive and execute .NET modules on the compromised machine. ESET researchers have focused on one of the latest cases, in 2024, in which the update of Tencent QQ software was hijacked. The malicious server that issues the update instructions is still active. This variant of WizardNet supports five commands, three of which allow it to execute .NET modules in memory, thus extending its functionality on the compromised system.

TheWizards and the Chinese company Dianke Network Security Technology (also known as UPSEC) – supplier of the DarkNights backdoor (also known as DarkNimbus), appear to be linked. According to NCSC UK, this malicious backdoor also has Tibetan and Uyghur communities among its primary targets. While TheWizards uses a different backdoor – the WizardNet, the hijacking server is configured to serve DarkNights to updating applications running on Android devices.

Neosurf, the progressive online payments company known for bridging the gap between cash and digital transactions and helping iGaming operators meet their AML and compliance requirements, has now launched in the regulated Mexican market.

With Mexico’s sports betting industry experiencing rapid growth and a strong player preference for alternative and cash-based payment solutions, Neosurf sees a significant opportunity to provide an enhanced range of market-tailored payment services to operators and players alike.

Neosurf’s cash-to-digital wallet solutions will enable Mexican players to fund their accounts securely while also giving operators access to robust compliance tools. With its pioneering Compliance Handshake feature, Neosurf provides an opportunity for seamless and secure KYC data sharing, improving the player journey and providing additional data and reporting for the operator

“In talking with operators, we’ve learnt that they’re not being serviced as well as they could be – there are gaps in customer support, compliance processes and overall payment efficiency,” explained Sue Page, CEO Americas at Neosurf.

“We believe our solution fills these gaps by offering a more reliable, secure and compliant way for players to transact, while also helping operators improve the all-round customer experience. We’re already live with first regional partners, such as Fun88, in the country and will quickly be adding more SEGOB licensed operators over the coming months.”

“With many Mexican players favouring cash, partnering with Neosurf allows us to offer a payment method that aligns with customer preferences while reinforcing our commitment to security and compliance,” added Christian Ramos, legal representative at Fun88 Mexico. “Their ability to provide frictionless transactions while enhancing AML and KYC processes makes them a key partner in the market.”

Neosurf’s launch in Mexico is just the beginning of its expansion into the regulated Latin American market, with the company already exploring further opportunities across the region. Through delivering its fast, secure and customer-centric payment solutions, Neosurf remains committed to reshaping the payments experience for players and operators, both within Mexico and beyond.

Advertisement

Caesars Entertainment announced an expansion of the WSOP Online poker platform, now pooling liquidity in Pennsylvania with its three existing jurisdictions: Nevada, New Jersey, and Michigan. The move positions Caesars as the first online poker operator to share liquidity across four U.S. jurisdictions, establishing WSOP Online as the only platform in the US where players from all four states can compete in the same player pool. The inclusion of Pennsylvania follows Michigan’s integration with Nevada and New Jersey on WSOP Online in May 2024, marking another significant milestone in the development of WSOP Online as the premier online poker site.

In addition to the announcement of shared liquidity across another jurisdiction, Caesars unveiled the 2025 WSOP Online Bracelet schedule. The schedule will once again feature 30 bracelet events coinciding with the 56th annual World Series of Poker, which will be held for the fourth consecutive year at Caesars Rewards destinations Paris Las Vegas and Horseshoe Las Vegas on the Las Vegas Strip.

“The addition of the Pennsylvania player pool to WSOP Online comes at the perfect time, and we’re ready to give avid poker players in The Keystone State the opportunity to raise the stakes on their poker play. This expansion enhances the experience for players by building even greater prize pools that are up for grabs all summer long as a part of our jam-packed WSOP Online schedule. We’re ready to see who earns our largest online prize pools ever once the first hands are dealt this summer,” said Danielle Barille, Vice President of Online Poker at Caesars Entertainment.

The first Online Bracelet event kicks off on May 31 with a total of 10 live final tables, and the final event begins on July 15. In 2025, WSOP Online will introduce an Online Bracelet Leaderboard, offering over $30,000 in prizes for the first time. Participants in the Online Gold Bracelet events will accumulate leaderboard points, with the highest scorer being honored as the 2025 WSOP Online Bracelet Player of the Year.

Every Tuesday, Saturday and Sunday of the series will feature an official gold bracelet up for grabs, from the $333 Triple Treys No Limit Hold’em event on June 8 to the $5,300 WSOP Online High Roller Championship on July 9. Last year, over $30 Million in prize money was awarded from Online Bracelet events in June and July. This year, the schedule is highlighted by six Mystery Bounty tournaments with $5.5 Million in guarantees.

In addition, exclusive satellites to qualify for land-based tournaments will be offered on WSOP Online, with entry fees as low as $1. These satellites will be daily single-table satellites and massive promotions, such as the guaranteed 25-seat Main Event mega-satellites on June 29 and July 1 where 25 $10,000 Main Event Seats are guaranteed for every event. Ten Online Bracelet events will also begin online, playing under a hybrid format, with their final tables contested live in Las Vegas at the WSOP. WSOP satellites outside the US are currently underway and held exclusively at GGPoker.

Players are permitted to play on WSOP Online while simultaneously participating in live WSOP events at the World Series of Poker in Las Vegas which will run from May 27 to July 16, with poker’s undisputed world championship, also known as the “Main Event,” beginning on July 2.