Knife Cutting the Edge: Disclosing a China-nexus gateway-monitoring AitM framework

Cisco Talos discovered and analyzed “DKnife,” a sophisticated Linux‑based gateway monitoring and AitM framework composed of seven ELF implants that perform deep packet inspection, DNS and update hijacking, credential harvesting, AV disruption, and delivery of ShadowPad, DarkNimbus and WizardNet backdoors; artifacts and code comments indicate China‑nexus operators, active C2 infrastructure (as of Jan 2026), and targeted Chinese‑language services though the tooling can affect a wide range of devices including routers, PCs, mobile and IoT devices.