Overview 27 indicators
No published description. This group is tracked by Maltrail from vendor reporting but is not named in MITRE ATT&CK, so there is no curated profile to show.
| ipv4 | 13 | THEWIZARDS.json |
| url | 10 | THEWIZARDS.json |
| domain | 4 | THEWIZARDS-domain.txt |
Principal sources 6 reports
Ranked by how many of this actor's indicators each report brought in.
- 26welivesecurity.com/en/eset-research/thewizards-apt-group-s…
- 26blog.talosintelligence.com/knife-cutting-the-edge
- 26github.com/eset/malware-ioc/tree/master/thewizards
- 26github.com/Cisco-Talos/IOCs/blob/main/2026/02/knif…
- 1x.com/skocherhan/status/2021067035447525705
- 1virustotal.com/gui/file/17a2dd45f9f57161b4cc40924296c4…
Related groups 1
What the sources have in common — not a claim that these are the same actor. See the whole graph.
Timeline 27 indicators
Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.
No indicator matches. Only the most recent 300 are on this page — the rest are in the JSON.
-
x.com/skocherhan/status/2021067035447525705 · virustotal.com/gui/file/17a2dd45f9f57161b4cc40924296c4…
110.92.64.177:8000 -
welivesecurity.com/en/eset-research/thewizards-apt-group-s… · blog.talosintelligence.com/knife-cutting-the-edge · github.com/eset/malware-ioc/tree/master/thewizards · github.com/Cisco-Talos/IOCs/blob/main/2026/02/knif…
domain assetsqq.com domain mkdmcdn.com domain ssl-dns.com domain vv.ssl-dns.com ipv4 110.185.104.180:8000 ipv4 117.175.185.81:8003 ipv4 43.132.205.118:81 ipv4 43.155.62.54:81 ipv4 47.238.107.83:81 ipv4 47.93.54.134:8001 ipv4 47.93.54.134:8003 ipv4 47.93.54.134:8005 ipv4 49.89.41.187:8001 ipv4 49.89.41.187:8002 ipv4 49.89.41.187:8003 ipv4 89.195.5.18:4553 url http://110.92.64.117 url http://110.92.64.17 url http://117.175.185.81 url http://210.56.49.72 url http://43.132.105.118 url http://43.155.62.54 url http://47.93.54.134 url http://49.89.41.187 url http://60.205.148.180 url http://61.139.76.99
Further reading 6
- github.com/Cisco-Talos/IOCs/blob/main/2026/02/knif…
- welivesecurity.com/en/eset-research/thewizards-apt-group-s…
- github.com/eset/malware-ioc/tree/master/thewizards
- blog.talosintelligence.com/knife-cutting-the-edge
- virustotal.com/gui/file/17a2dd45f9f57161b4cc40924296c4…
- x.com/skocherhan/status/2021067035447525705