Forest Global Training Partners

Cyber Risks · Cisco Talos

Knife Cutting the Edge: Disclosing a China-nexus gateway-monitoring AitM framework

Summary: Cisco Talos found a Linux ELF binary talking to the same C2 server as the DarkNimbus backdoor, which pulled down a gzip archive containing a gateway monitoring and adversary-in-the-middle framework its developer calls DKnife; artifact metadata puts its use at least as far back as 2019, with the C2 still active as of January 2026. DKnife is built from seven ELF components that run on Linux edge and router firmware and perform DNS hijacking, Android update hijacking, delivery of ShadowPad and DarkNimbus, selective disruption of security-product traffic, and exfiltration of user activity, with 185 JSON files configured to hijack mostly Chinese-language apps.

What you should know: A framework sitting on edge routers since at least 2019 can intercept update manifests and swap legitimate downloads for ShadowPad and DarkNimbus, and Talos found its URL redirection paths and port configurations identical to those of the WizardNet and Spellbinder campaign that ESET reported targeting the Philippines, Cambodia, and the United Arab Emirates.

Read the original at Cisco Talos ↗

Topics
Malware
Related