Chinese-Made Malware Kit Targets Chinese-Based Routers and Edge Devices
ID: dac1268e-82f3-502f-8b50-9cdbb65fc17f
STIX ID: report--dac1268e-82f3-502f-8b50-9cdbb65fc17f
Feed Name: Infosecurity Magazine (News)
Threat Score
A Cisco Talos analysis describes DKnife, a Linux (x86-64) gateway-level AitM framework active since at least 2019 and observed in January 2026; composed of seven ELF components, it enables deep packet inspection, traffic interception, DNS hijacking, download replacement and delivery/updates for backdoors (DarkNimbus, ShadowPad), targets CentOS/RHEL-based routers and edge devices, and is attributed with high confidence to Chinese-nexus operators with infrastructure overlaps to other AitM campaigns.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.