DKnife toolkit abuses routers to spy and deliver malware since 2019

DKnife is a multi-component Linux-based adversary-in-the-middle (AitM) toolkit identified by Cisco Talos that compromises routers and edge devices to perform deep-packet inspection, hijack DNS and software/update downloads, terminate TLS, and deliver backdoors (ShadowPad, DarkNimbus). Used since at least 2019 and active in January 2026, the framework targets primarily Chinese-speaking users, intercepts credentials and app/OS updates, disrupts security tools, and demonstrates high technical sophistication and operational persistence.