The “All-in-One” Spy: DKnife Malware Hijacks Routers to Swap Downloads

Cisco Talos disclosed "DKnife", a multi-component Linux-based adversary-in-the-middle framework active since 2019 that compromises routers and edge devices to perform deep packet inspection, manipulate downloads and updates (hijacking Android and Windows installers), evade security tools, harvest credentials (targeting Chinese services), and deliver/backstop known backdoors ShadowPad and DarkNimbus—representing a highly targeted, nation-linked campaign that transforms network gateways into persistent surveillance and malware distribution checkpoints.