China-Nexus Hackers Hijacking Linux-Based Devices to Manipulate Traffic and Deploy Malware

**Executive summary:** DKnife is a China-linked, high-sophistication adversary-in-the-middle framework that compromises Linux routers and edge devices to perform deep packet inspection, hijack software update downloads, and deliver backdoors (e.g., ShadowPad, DarkNimbus), enabling persistent network-wide espionage and disruption of security product updates.