Latest News
Churchill Downs Incorporated Reports 2024 Fourth Quarter and Full Year Results

Churchill Downs Incorporated (Nasdaq: CHDN) (the “Company”, “CDI”, “we”) today reported business results for the quarter and full year ended December 31, 2024.
Company Highlights
- Record fourth quarter 2024 financial results compared to the prior year:
- Net revenue of $624.2 million, up $63.0 million or 11%
- Net income attributable to CDI of $71.7 million, up $14.1 million or 24%
- Adjusted EBITDA of $236.6 million, up $17.5 million or 8%
- Record 2024 financial results compared to the prior year:
- Net revenue of $2.7 billion, up $272.6 million or 11%
- Net income attributable to CDI of $426.8 million, up $9.5 million or 2%
- Adjusted EBITDA of $1.2 billion, up $135.3 million or 13%
- We successfully ran the 150th Kentucky Derby on the first Saturday of May generating all-time record all-sources handle and all-time record Derby Week Adjusted EBITDA.
- We opened the Terre Haute Casino Resort in Indiana in April 2024, and the hotel in May 2024.
- The Rose Gaming Resort opened in Dumfries, Virginia in November 2024, with 1,650 historical racing machines and a 102-room hotel as our eighth HRM entertainment venue in Virginia.
- We opened Owensboro Racing & Gaming in Owensboro, Kentucky on February 12, 2025, with 600 historical racing machines, a retail sportsbook, simulcast wagering, and food and beverage offerings.
- We ended 2024 with net bank leverage of 4.0x and returned $218.3 million of capital to shareholders through share repurchases and dividends.
CONSOLIDATED RESULTS |
Fourth Quarter | Years Ended December 31 | ||||||||||
(in millions, except per share data) | 2024 | 2023 | 2024 | 2023 | |||||||
Net revenue | $ | 624.2 | $ | 561.2 | $ | 2,734.3 | $ | 2,461.7 | |||
Net income attributable to CDI | $ | 71.7 | $ | 57.6 | $ | 426.8 | $ | 417.3 | |||
Diluted EPS attributable to CDI | $ | 0.95 | $ | 0.76 | $ | 5.68 | $ | 5.49 | |||
Adjusted EBITDA(a) | $ | 236.6 | $ | 219.1 | $ | 1,159.2 | $ | 1,023.9 | |||
(a) This is a non-GAAP measure. See explanation of non-GAAP measures below. |
SEGMENT RESULTS |
The summaries below present revenue from external customers and intercompany revenue from each of our reportable segments. We have changed the name of the TwinSpires segment to Wagering Services and Solutions to better reflect the businesses that are within this segment. All comparisons are against the applicable prior year period unless otherwise noted.
Live and Historical Racing
Fourth Quarter | Years Ended December 31, | ||||||||||
(in millions) | 2024 | 2023 | 2024 | 2023 | |||||||
Revenue | $ | 275.5 | $ | 235.3 | $ | 1,267.0 | $ | 1,084.6 | |||
Adjusted EBITDA | 101.6 | 88.9 | 574.6 | 475.4 |
Fourth Quarter 2024
Fourth quarter 2024 revenue increased $40.2 million due to a $19.6 million increase primarily from the opening of The Rose Gaming Resort in Northern Virginia, a $10.4 million increase from our other Virginia HRM venues, a $4.1 million increase from our Southwestern Kentucky HRM venue, a $2.7 million increase at Churchill Downs Racetrack, a $2.1 million increase from our Northern Kentucky HRM venues, and a $1.3 million net increase from our other HRM venues.
Fourth quarter 2024 Adjusted EBITDA increased $12.7 million due to a $5.2 million increase primarily from the opening of The Rose Gaming Resort in Northern Virginia, a $7.6 million increase from our other Virginia HRM venues, a $2.1 million increase from our Southwestern Kentucky HRM venue, and a $1.5 million increase from our Northern Kentucky HRM venues. These increases were offset by a $1.8 million decrease related to an increase in government relations expense allocated to Virginia, a $1.3 million decrease at Churchill Downs Racetrack and a $0.6 million decrease at our other HRM venues.
Full Year 2024
Full year 2024 revenue increased $182.4 million due to a $57.2 million increase at Churchill Downs Racetrack due to a record-breaking 150th Derby Week, a $25.9 million increase in Northern Virginia including the opening of The Rose Gaming Resort, a $17.2 million increase from the opening of the Rosie’s Emporia HRM venue in Southern Virginia in September 2023, a $39.5 million increase from our other Virginia HRM venues, a $41.5 million increase from our Kentucky HRM venues, and a $1.1 million increase from our New Hampshire venue.
Full year 2024 Adjusted EBITDA increased $99.2 million due to a $32.6 million increase at Churchill Downs Racetrack due to a record-breaking 150th Derby Week, $9.7 million increase in Northern Virginia including the opening of The Rose Gaming Resort, a $7.1 million increase from the opening of the Rosie’s Emporia HRM venue in Southern Virginia in September 2023, a $38.3 million increase from our other Virginia HRM venues, and an $11.5 million increase primarily from our other Kentucky HRM venues.
Wagering Services and Solutions
Fourth Quarter | Years Ended December 31, | ||||||||||
(in millions) | 2024 | 2023 | 2024 | 2023 | |||||||
Revenue | $ | 108.0 | $ | 110.6 | $ | 500.7 | $ | 458.4 | |||
Adjusted EBITDA | 37.3 | 34.9 | 165.6 | 132.1 |
Fourth Quarter 2024
Fourth quarter 2024 revenue decreased $2.6 million due to a $3.5 million decrease from our sports betting business and a $1.3 million decrease in TwinSpires Horse Racing primarily due to market access and shifts in race days at other tracks. These decreases were partially offset by a $2.2 million increase from Exacta primarily from the growth of our Virginia HRM venues.
Fourth quarter 2024 Adjusted EBITDA increased $2.4 million due to a $2.1 million increase from our Exacta business primarily because of increased fees from the growth of our Virginia HRM venues, a $2.2 million increase from a one-time reduction in compensation expenses related to our Exacta business, and a $0.3 million increase in TwinSpires Horse Racing. These increases were partially offset by a $2.2 million decrease primarily from our sports betting business.
Full Year 2024
Full year 2024 revenue increased $42.3 million due to a $40.8 million increase from our Exacta business primarily from growth in our third party HRM business and from the growth of our Virginia HRM venues and a $2.0 million increase from our sports betting business, partially offset by a $0.5 million decrease from TwinSpires Horse Racing.
Full year 2024 Adjusted EBITDA increased $33.5 million due to a $29.2 million increase from our Exacta business because of increased fees from our Virginia HRM venues, a $2.2 million increase from a one-time reduction in accrued compensation expenses related to our Exacta business, and a $2.6 million increase primarily from our sports betting business, partially offset by a $0.5 million decrease from TwinSpires Horse Racing.
Gaming
Fourth Quarter | Years Ended December 31, | ||||||||||
(in millions) | 2024 | 2023 | 2024 | 2023 | |||||||
Revenue | $ | 257.5 | $ | 230.2 | $ | 1,045.4 | $ | 974.6 | |||
Adjusted EBITDA | 120.1 | 113.4 | 506.9 | 488.6 |
Fourth Quarter 2024
Fourth quarter 2024 revenue increased $27.3 million due to a $30.3 million increase from the opening of the Terre Haute Casino Resort, partially offset by a $3.0 million decrease from our other wholly owned gaming properties primarily due to regional gaming softness and increased competition.
Fourth quarter 2024 Adjusted EBITDA increased $6.7 million due to an $11.4 million increase from the opening of the Terre Haute Casino Resort and a $2.7 million increase from our equity investment in Miami Valley Gaming. These increases were partially offset by a $2.3 million decrease from our other wholly owned gaming properties and a $5.1 million decrease from our equity investment in Rivers Des Plaines primarily due to regional gaming softness, increased competition, and higher labor and benefit expense.
Full Year 2024
Full year 2024 revenue increased $70.8 million primarily due to a $96.6 million increase from the opening of the Terre Haute Casino Resort. This increase was partially offset by a $15.6 million decrease from our other wholly owned gaming properties primarily due to inclement weather in January 2024, regional gaming softness, and increased competition; and a $10.2 million decrease due to our decision not to renew the management agreement at Lady Luck at the end of June 2023.
Full year 2024 Adjusted EBITDA increased $18.3 million primarily due to a $44.5 million increase from the opening of the Terre Haute Casino Resort and a $3.0 million increase from our equity investment in Miami Valley Gaming. These increases were partially offset by a $19.5 million decrease from our wholly owned gaming properties and an $8.5 million decrease from our equity investment in Rivers Des Plaines primarily due to inclement weather in January 2024, regional gaming softness, increased competition, and higher labor and benefit expense; and a $1.2 million decrease from proceeds for business interruption insurance claims in the third quarter 2023 that did not reoccur.
All Other
Fourth Quarter | Years Ended December 31, | ||||||||||||||
(in millions) | 2024 | 2023 | 2024 | 2023 | |||||||||||
Revenue | $ | 2.1 | $ | 0.2 | $ | 6.6 | $ | 0.9 | |||||||
Adjusted EBITDA | (22.4 | ) | (18.1 | ) | (87.9 | ) | (72.2 | ) |
Fourth Quarter 2024
Fourth quarter 2024 revenue increased $1.9 million due to intercompany revenue related to the captive insurance company that was established in April 2024. All captive revenue is eliminated in consolidation.
Fourth quarter 2024 Adjusted EBITDA decreased $4.3 million driven primarily by increased corporate compensation related expenses and other corporate administrative expenses driven by enterprise growth.
Full Year 2024
Full year 2024 revenue increased $5.7 million primarily due to intercompany revenue related to the captive insurance company that was established in April 2024. All captive revenue is eliminated in consolidation.
Full year 2024 Adjusted EBITDA decreased $15.7 million driven primarily by increased corporate compensation related expenses and other corporate administrative expenses driven by enterprise growth.
CAPITAL MANAGEMENT |
Share Repurchase Program
The Company repurchased 160,466 shares of its common stock at a total cost of $21.3 million based on trade date under its share repurchase program in the fourth quarter of 2024. The Company repurchased 506,300 shares of its common stock at a total cost of $65.3 million based on trade date under its share repurchase program in 2024. We had $149.6 million of repurchase authority remaining under this program as of December 31, 2024.
Annual Dividend
On October 22, 2024, the Company’s Board of Directors approved an annual cash dividend on the Company’s common stock of $0.409 per outstanding share, a seven percent increase over the prior year. The dividend was paid on January 3, 2025, to shareholders of record as of the close of business on December 6, 2024, with the aggregate cash dividend paid to each shareholder rounded to the nearest whole cent. This marks the fourteenth consecutive year that the Company has increased the dividend per share.
Capital Investments
We currently expect our project capital to be approximately $350 to $400 million in 2025, although this amount may vary significantly based on the timing of work completed, unanticipated delays, and timing of payments to third parties. We plan to use our operating cash flows and existing revolving credit facility to fund our capital project expenditures.
NET INCOME ATTRIBUTABLE TO CDI |
Fourth Quarter 2024 Results
The Company’s fourth quarter 2024 net income attributable to CDI was $71.7 million compared to $57.6 million in the prior year quarter.
The following factors impacted the comparability of the Company’s fourth quarter 2024 net income to the prior year quarter:
- a $9.9 million after-tax decrease in transaction, pre-opening, and other expense primarily from the settlement of certain liabilities recorded at the time of the Company’s November 2022 acquisition of substantially all of the assets of Peninsula Pacific Entertainment LLC,
- a $1.7 million after-tax increase in other charges and recoveries, net primarily related to non-recurring insurance claim recoveries,
- a $0.2 million decrease of after-tax other charges; and
- a $0.1 million decrease in after-tax non-cash asset impairments.
This was partially offset by:
- a $1.1 million after-tax decrease primarily from legal reserves.
Excluding the items above, fourth quarter 2024 adjusted net income attributable to CDI increased $3.3 million primarily due to the following:
- a $3.9 million after-tax increase primarily driven by the results of our operations,
- partially offset by a $0.6 million after-tax increase in interest expense associated with higher outstanding debt balances and higher interest rates.
Full Year 2024 Results
The Company’s full year 2024 net income attributable to CDI was $426.8 compared to $417.3 million in the prior year.
The following factors impacted comparability of the Company’s net income for the year ended December 31, 2024 compared to the prior year:
- an $86.2 million after-tax gain on the sale of the Arlington property in the prior year; and
- a $0.7 million after-tax decrease primarily from legal reserves.
This was partially offset by:
- a $15.7 million after-tax decrease in non-cash asset impairments,
- a $12.8 million after-tax decrease in transaction, pre-opening, and other expense primarily from the settlement of certain liabilities recorded at the time of the Company’s November 2022 acquisition of substantially all of the assets of Peninsula Pacific Entertainment LLC,
- a $5.1 million after-tax increase of other charges and recoveries, net primarily related to non-recurring insurance claim recoveries; and
- a $1.6 million after-tax decrease of other charges.
Excluding these items, full year 2024 adjusted net income attributable to CDI increased $61.2 million primarily due to the following:
- a $77.0 million after-tax increase primarily driven by the results of our operations and equity income from our unconsolidated affiliates,
- partially offset by a $15.8 million after-tax increase in interest expense associated with higher outstanding debt balances and higher interest rates.
Conference Call
A conference call regarding this news release is scheduled for Thursday, February 20, 2025 at 9 a.m. ET. Investors and other interested parties may listen to the teleconference by accessing the online, real-time webcast and broadcast of the call at churchilldownsincorporated.com/events.cfm, or by registering in advance via teleconference here. Once registration is completed, participants will be provided with a dial-in number containing a personalized conference code to access the call. All participants are encouraged to dial-in 15 minutes prior to the start time. An online replay will be available by noon ET on Thursday, February 20, 2025. A copy of the Company’s news release announcing quarterly results and relevant financial and statistical information about the period will be accessible at churchilldownsincorporated.com.
Use of Non-GAAP Measures
In addition to the results provided in accordance with GAAP, the Company also uses non-GAAP measures, including adjusted net income, adjusted diluted EPS, EBITDA (earnings before interest, taxes, depreciation and amortization), and Adjusted EBITDA.
The Company uses non-GAAP measures as a key performance measure of the results of operations for purposes of evaluating performance internally. These measures facilitate comparison of operating performance between periods and help investors to better understand the operating results of the Company by excluding certain items that may not be indicative of the Company’s core business or operating results. The Company believes the use of these measures enables management and investors to evaluate and compare, from period to period, the Company’s operating performance in a meaningful and consistent manner. The non-GAAP measures are a supplemental measure of our performance that is not required by, or presented in accordance with, GAAP, and should not be considered as an alternative to, or more meaningful than, net income or diluted EPS (as determined in accordance with GAAP) as a measure of our operating results.
We use Adjusted EBITDA to evaluate segment performance, develop strategy, and allocate resources. We utilize the Adjusted EBITDA metric to provide a more accurate measure of our core operating results and enable management and investors to evaluate and compare from period to period our operating performance in a meaningful and consistent manner. Adjusted EBITDA should not be considered as an alternative to operating income as an indicator of performance, as an alternative to cash flows from operating activities as a measure of liquidity, or as an alternative to any other measure provided in accordance with GAAP. Our calculation of Adjusted EBITDA may be different from the calculation used by other companies and, therefore, comparability may be limited.
Adjusted net income and adjusted diluted EPS exclude discontinued operations net income or loss; net income or loss attributable to noncontrolling interest; changes in fair value for interest rate swaps related to Rivers Des Plaines; Rivers Des Plaines’ legal reserves and transaction costs; transaction expense, which includes acquisition and disposition related charges, as well as legal, accounting, and other deal-related expense; pre-opening expense; and certain other gains, charges, recoveries, and expenses.
Adjusted EBITDA includes our portion of EBITDA from our equity investments and the portion of EBITDA attributable to noncontrolling interest.
Adjusted EBITDA excludes:
- Transaction expense, net which includes:
- Acquisition, disposition, and property sale related charges;
- Other transaction expense, including legal, accounting, and other deal-related expense;
- Stock-based compensation expense;
- Asset impairments;
- Gain on property sales;
- Legal reserves;
- Pre-opening expense; and
- Other charges, recoveries, and expenses.
As of December 31, 2021, our property in Arlington Heights, Illinois (“Arlington”) ceased racing and simulcast operations and the property was sold on February 15, 2023 to the Chicago Bears. Arlington’s results and exit costs in 2023 are treated as an adjustment.
For segment reporting, Adjusted EBITDA includes intercompany revenue and expense totals that are eliminated in the Consolidated Statements of Comprehensive Income. See the Reconciliation of Net Income to Adjusted EBITDA included herewith for additional information.
Latest News
EveryMatrix set for another standout year with strong Q1 performance

EveryMatrix has kicked off 2025 with powerful momentum, reporting a standout first quarter of exceptional revenue growth and profitability.
The tier-1 iGaming technology platform supplier delivered a very strong first quarter performance, with net revenue reaching €54 million, up 39% Year-on-Year (YoY), and EBITDA increasing to €28m, up 27% YoY, driven by strong growth from existing clients and innovative product launches.
EBITDA margin reached 52%, making it the eighth consecutive quarter above 50%, as the company continues to scale its platform and casino content technologies while maintaining strong financial discipline.
The last twelve months’ EBITDA reached €107m, up 50% YoY, building on 2024’s milestone achievement of surpassing €100 million in annual EBITDA.
Q1 MILESTONES SIGNAL POWERHOUSE YEAR AHEAD
A highlight of the first quarter was the successful migration of Bet600 – the first full turnkey FSB Technologies customer in the UK – to the EveryMatrix platform. The company aim remains to have all clients fully migrated in 2025 thereby realizing large cost synergies from this key acquisition.
EveryMatrix launched its cutting-edge proprietary Horse Racing solution by combining FSB’s proven knowledge and experience in Horse Racing with the innovation of OddsMatrix development teams. It provides global horse racing coverage with 10k+ monthly events, full system bets offering with bonusing capabilities and configurations and a purpose-built Horse Racing front end with rich Racecard content & live streaming integrations among some of the features.
A landmark deal was signed to deliver a full casino turnkey platform solution to SkyCity Entertainment Group. SkyCity is one of New Zealand’s largest entertainment companies owning five land-based casinos across both NZ and Australia and the online casino brand SkyCitycasino.com. SkyCity migrates from their current provider to EveryMatrix later this year.
SPORTS SURGE AND STRONG CASINO & PLATFORM GROWTH
Q1 2025 saw the company’s sports division deliver exceptional growth, with quarterly sports turnover rising 30% YoY to €1.7b, while GGR climbing 60% YoY to €154m on the back of continued strong trading margins. The last twelve months (LTM) turnover hit €6.3b, reflecting a 48% YoY increase, with GGR rising by 92% YoY to €505m. Part of the growth came from reaching a record number of nearly 600,000 live events, a 24% YoY increase.
Casino experienced the strongest quarterly financial results to date, with net revenue climbing to €28.6m, up 44% YoY, while EBITDA reached €16.8m, up 29% YoY. Casino GGR reached €753m, a 22% YoY increase, with the LTM reaching €2.9b, a 38% YoY increase.
GamMatrix, the company’s Gaming and Player Account Management Platform, experienced a net revenue increase of €8.6m, up 18% YoY, while EBITDA landed at €2.4m, a 23% decrease YoY. The decrease in EBITDA margin is related to a change in internal revenue allocation.
Ebbe Groes, Group CEO of EveryMatrix, said: “I’m very excited for 2025. Q1 was a solid quarter, a great start, and the rest of the year looks just as promising. We had a phenomenal year in 2024, which will be hard to beat, but thanks to the momentum we’ve set in motion during the last few years, I’m sure we’ll be able to do it.
“Our sports division never ceases to amaze me, breaking record after record. This quarter, we managed to reach 600,000 live events, all thanks to our ability to expand our coverage and add new products and features even while experiencing this much continuous growth.”
Q1 2025 HIGHLIGHTS
- Reached net revenue of €54m, up 39% YoY, with EBITDA at €28m, up 27% YoY, driven primarily by strong growth from existing clients.
- EBITDA margin reached 52%. Last twelve months’ EBITDA reached €107m, up 50% YoY.
- Migrated Bet600 from FSB to EveryMatrix platform, the company’s first such migration.
- OddsMatrix’s brand new Horse Racing product went live with this launch.
- Signed New Zealand’s SkyCity Entertainment Group to deliver a full casino turnkey platform solution.
- First three dedicated blackjack tables went live, another step up for the business’ PlayMatrix live dealer product.
- Launched OddsMatrix feeds for LeoVegas Group to enhance their global sportsbook offering.
- Won Norsk Tipping’s Casino and eInstant RFP, the largest-ever SlotMatrix deal, delivering aggregation, in-house and bespoke content.
- Launched SlotMatrix casino content with Caesars Entertainment across five U.S. states, expanding U.S. presence (post-quarter).
- Introduced New Odds Models for Football and Handball and enhanced retail Self Service Betting Terminals (SSBTs).
- Introduced real-time Rakeback through LoyalityEngine, the company’s Newly Launched Cross-Vertical Loyalty Program.
- Integrated 14 new casino vendors, now totalling 185+ and 345+ content providers.
- Signed 20 new PartnerMatrix clients.
Latest News
Rising Digital chooses Continent 8 as strategic cybersecurity partner for US iGaming operations

Global games developer deploys Continent 8’s Compliance Audit, Vulnerability Assessment and Penetration Testing (VAPT) and Vulnerability Scan (V-Scan) services to swiftly meet multi-state regulatory compliance requirements
Continent 8 Technologies, the leading provider of global managed hosting, connectivity, cloud and cybersecurity solutions to the iGaming and online sports betting industry, is pleased to announce an expanded partnership with global leading Asian game developer, Rising Digital Corporation. Through this enhanced collaboration, Rising Digital has selected Continent 8 as its dedicated cybersecurity services provider.
Rising Digital, a current infrastructure partner leveraging Continent 8’s cloud solution for high-performance connectivity, high availability and uninterrupted uptime of gaming platforms, has established a strategic alliance with Continent 8 to enhance its cybersecurity program and standards. This initiative allows Rising Digital to utilize Continent 8’s complete suite of regulatory cybersecurity services, ensuring full compliance within each US state it operates in.
Rising Digital has successfully launched its cybersecurity program across multiple states, including Connecticut, Delaware, Michigan, New Jersey, Pennsylvania and West Virginia, as well as the Canadian province of Ontario, to comply with the specific regulatory requirements of each jurisdiction. In collaboration with Continent 8 and its cybersecurity specialist division, C8 Secure, Rising Digital has successfully completed Compliance Audit, Vulnerability Assessment and Penetration Testing (VAPT) and Vulnerability Scan (V-Scan) services. These comprehensive regulatory cybersecurity services ensure compliance with local regulatory standards and identify potential vulnerabilities, providing actionable insights to strengthen the organization’s overall cybersecurity posture.
Aimin Cong, CEO of Rising Digital, said: “We are delighted to formalize our relationship with Continent 8 for our growing iGaming operations business. With the utmost importance being placed upon compliance, performance and security, we believe Continent 8 is an excellent infrastructure and cybersecurity services partner.”
Patrick Gardner, Chief Security Officer at Continent 8, said: “We are honored that Rising Digital has placed its trust in Continent 8 as its infrastructure and cybersecurity partner as they expand their operations across the United States.
“At Continent 8, we pride ourselves as being a one-stop-shop provider of infrastructure, cloud, regulatory and cybersecurity solutions. Our services enable iGaming companies like Rising Digital to swiftly meet multi-state regulatory requirements, safeguarding their operations while providing peace of mind. We stand committed to setting the highest standards and value for cybersecurity and compliance services within the ever-growing iGaming and online sports betting sector.”
Continent 8 will be at SBC Summit Americas, from May 13-15 at Booth D750. Schedule a show meeting to learn more about the best practices and strategies for your organization’s regulatory cybersecurity requirements.
Latest News
ESET Research analyzes tools from the China-aligned TheWizards group, with targets across Asia and the Middle East

ESET researchers have analyzed Spellbinder, a lateral movement tool used to perform adversary-in-the-middle attacks by the China-aligned threat actor TheWizards. Spellbinder enables adversary-in-the-middle attacks through IPv6 stateless address autoconfiguration spoofing, which allows the attackers to redirect the update protocols of legitimate Chinese software to malicious servers. Then the legitimate software is tricked into downloading and executing the malicious components that launch the backdoor WizardNet.
TheWizards has been constantly active since at least 2022 until the present and, according to ESET telemetry, targets individuals, gambling companies, and unknown entities in the Philippines, Cambodia, the United Arab Emirates, mainland China, and Hong Kong.
“We initially discovered and analyzed this tool in 2022, and observed a new version with a few changes that was deployed to compromised machines in 2023 and 2024,” says ESET researcher Facundo Muñoz, who analyzed Spellbinder and WizardNet. “Our research led us to discover a tool used by the attackers that is designed to perform adversary-in-the-middle attacks using IPv6 SLAAC spoofing to intercept and reply to packets in a network, allowing the attackers to redirect traffic and serve malicious updates to legitimate Chinese software,” explains Muñoz.
The final payload in the attack is a backdoor that we named WizardNet – a modular implant that connects to a remote controller to receive and execute .NET modules on the compromised machine. ESET researchers have focused on one of the latest cases, in 2024, in which the update of Tencent QQ software was hijacked. The malicious server that issues the update instructions is still active. This variant of WizardNet supports five commands, three of which allow it to execute .NET modules in memory, thus extending its functionality on the compromised system.
TheWizards and the Chinese company Dianke Network Security Technology (also known as UPSEC) – supplier of the DarkNights backdoor (also known as DarkNimbus), appear to be linked. According to NCSC UK, this malicious backdoor also has Tibetan and Uyghur communities among its primary targets. While TheWizards uses a different backdoor – the WizardNet, the hijacking server is configured to serve DarkNights to updating applications running on Android devices.
-
Daily Fantasy Sports6 days ago
Assessing the esports DFS opportunity in the US
-
Latest News6 days ago
PrizePicks Teams Up with San Francisco Giants as Official DFS Partner
-
Compliance Updates6 days ago
MGCB Targets 11 Illegal Online Casinos Operating Without Licenses
-
Compliance Updates5 days ago
IC360 Announces Integrity Partnership with PGA of America
-
Latest News5 days ago
PENN Entertainment Announces Board Refreshment
-
Latest News4 days ago
ESET Research analyzes tools from the China-aligned TheWizards group, with targets across Asia and the Middle East
-
Latest News4 days ago
Spinomenal games now available on Hard Rock Bet strengthening its position in New Jersey
-
Interviews4 days ago
Betbazar Explores Cricket in iGaming: What Operators Need to Know