Knife Cutting the Edge: Disclosing a China-nexus gateway-monitoring AitM framework

Cisco Talos uncovered 'DKnife', a sophisticated gateway-monitoring and adversary-in-the-middle (AitM) framework comprising seven Linux-based implants. Used since 2019, DKnife performs deep-packet inspection, traffic manipulation, and malware delivery via routers and edge devices. It targets various devices, including PCs, mobile devices, and IoT, delivering ShadowPad and DarkNimbus backdoors. The framework primarily targets Chinese-speaking users, with evidence suggesting China-nexus threat actors as operators. DKnife's capabilities include DNS hijacking, Android application update hijacking, Windows binary hijacking, anti-virus traffic disruption, and user activity monitoring. A link to the WizardNet campaign was also discovered, indicating a shared development or operational lineage.

• One Target, Two Flags | Rival Espionage Actors Converge On Pakistani Law EnforcementMalware2026-07-09
• Melofee: a look back at a Linux implant and its new variantsMalware2026-09-10
• SilkParasite: Tracking a China-Nexus APT Across Central AsiaMalware2026-08-20
• India's government and energy sectors targeted with ZOHOMURK and MINIRECONMalware2026-06-29
• Hallucinating Credibility: China-Aligned TA419 Impersonates its Way into US AI Policy CirclesCampaign2026-10-01