China-Linked DKnife AitM Framework Targets Routers for Traffic Hijacking, Malware Delivery

Cisco Talos disclosed DKnife, an advanced Linux-based gateway-monitoring and adversary‑in‑the‑middle (AitM) framework active since at least 2019 that runs on routers and edge devices to perform deep packet inspection, TLS termination, DNS hijacking, credential harvesting, and the hijacking of binary and Android app updates to deliver backdoors (notably ShadowPad and DarkNimbus); the toolkit is modular (seven components), targets Chinese-speaking users and services, and is linked to other China‑aligned clusters such as Earth Minotaur and TheWizards, presenting a high-risk supply-chain and infrastructure threat.