Loading story…
Cisco Talos disclosed DKnife, a China-nexus adversary-in-the-middle (AitM) framework that compromises Linux-based routers and edge devices to perform deep-packet inspection, manipulate network traffic, and deliver additional malware. Talos assessed DKnife has been in use since at least 2019, with associated C2 infrastructure still active as of January 2026, and described it as a multi-component toolset (seven Linux implants) that turns compromised gateways into persistent surveillance and attack platforms affecting downstream PCs, mobile devices, and IoT systems.
DKnife enables attackers to hijack legitimate downloads and updates—including binary downloads and Android app updates—and replace them with malicious payloads to install backdoors such as ShadowPad and DarkNimbus; reporting also notes links to activity associated with WizardNet and another AitM framework, Spellbinder, suggesting shared development or operational lineage. The tooling appears focused on Chinese-speaking users, based on credential-harvesting and exfiltration modules for Chinese-language services and references to Chinese media domains, and it can also interfere with defensive visibility by selectively disrupting traffic (including potentially blocking antivirus update/communications) once the router/edge device is under attacker control.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
With its disclosure, Talos released indicators of compromise and ClamAV signatures for DKnife-related activity and said it was coordinating mitigations with the relevant device vendor.
On February 5, 2026, Cisco Talos published research on DKnife, describing a seven-component Linux ELF gateway-monitoring and AitM framework used by a China-nexus threat actor and primarily configured to target Chinese-speaking users.
Talos reported that associated DKnife command-and-control servers were still active as of January 2026, indicating the framework's operations were ongoing.
During its investigation, Talos found DKnife being used to deliver and support the ShadowPad and DarkNimbus backdoors and identified infrastructure overlap and behavioral similarities with WizardNet and the Spellbinder AitM framework, suggesting shared development or operational lineage.
Cisco Talos assessed that the DKnife adversary-in-the-middle framework has been used since at least 2019 to compromise Linux-based routers and edge devices for traffic inspection, manipulation, credential theft, and malware delivery.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 22 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
11 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcehackread.com
Open sourcesecurityonline.info
Open sourcecsoonline.com
Open sourcebleepingcomputer.com
Open sourcethehackernews.com
Open sourcecybersecuritynews.com
Open sourceblog.talosintelligence.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported a China-linked espionage campaign targeting enterprise edge routers in Southeast Asia with a custom Linux implant called `router.elf`. The malware uses encrypted HTTPS command-and-control over port 443 and Cloudflare DNS over HTTPS to conceal communications, while modifying `iptables` NAT rules to redirect downstream DNS traffic to attacker-controlled resolvers. Analysts said this gives the operators an infrastructure-level foothold for surveillance, traffic interception, and possible manipulation of internal network activity, including software update flows. The operation also appears to extend from compromised routers into Windows environments. Investigators linked the Linux activity to a secondary backdoor, `client_rc_start`, and to a Windows intrusion chain that deploys a Cobalt Strike Beacon through DLL sideloading, using a malicious `version.dll` loaded by `CrashReport.exe`. Shared command-and-control domains, URI patterns, cookie markers, user-agent values, and beacon timing indicate centralized control across the Linux and Windows components, while attribution clues cited in reporting include Mandarin-language strings, a `zh-CN` setting, and tooling overlaps with earlier China-linked operations.
Jun 29, 2026
Researchers detailed multiple China-aligned intrusion sets using modular tooling to compromise targets across Windows, web, and mobile environments. ESET said **TheWizards** used a tool called **Spellbinder** to abuse IPv6 `SLAAC` by sending rogue `ICMPv6 Router Advertisements`, positioning the attackers as the default gateway for adversary-in-the-middle operations. The group then intercepted DNS requests for Chinese software vendors and redirected update traffic so legitimate applications such as **Tencent QQ** and previously **Sogou Pinyin** fetched malicious payloads instead of real updates. The resulting infection chain used a downloader DLL, an encrypted blob, and in-memory loading of the **WizardNet** backdoor, which patched `AMSI` and `ETW`, supported modular execution, and injected shellcode into other processes while maintaining encrypted command-and-control. Separate reporting described broader China-linked operations using flexible malware delivery and post-compromise frameworks. Trend Micro tied **Earth Minotaur** to the **MOONSHINE Exploit Kit** and the **DarkNimbus** Android backdoor, while TrendAI documented **PeckBirdy**, a JScript-based framework used since 2023 across browsers, `MSHTA`, `WScript`, Classic ASP, Node.js, and `.NET ScriptControl` for watering-hole attacks, credential theft, lateral movement, reverse shells, and persistent backdoor access. PeckBirdy was observed in campaigns against Chinese gambling sites, Asian government entities, and private organizations, alongside modular backdoors **HOLODONUT** and **MKDOOR**. The reporting also noted infrastructure and tooling overlaps linking some of these activities to **UNC3569**, **Earth Baxia**, and supplier **UPSEC**, underscoring an ecosystem of China-aligned operators reusing shared malware, hijacking infrastructure, and fake software-update lures.
Aug 21, 2026
Cisco Talos disclosed that **UAT-7290**, a threat actor active since at least 2022 and assessed with high confidence as part of the **China-nexus APT ecosystem**, has conducted sustained intrusions against high-value **telecommunications and critical infrastructure** organizations in **South Asia**, with more recent activity extending into **Southeastern Europe**. The group reportedly performs extensive pre-attack reconnaissance, then compromises public-facing edge devices through **one-day exploits**, proof-of-concept exploit adaptation, and **target-specific SSH brute force**, seeking deep and persistent access inside strategically important telecom environments. Researchers said the actor relies heavily on a **Linux-focused malware** toolkit that includes **RushDrop**, **DriveSwitch**, **SilentRaid**, and **Bulbature**, alongside overlaps with **RedLeaves** and **ShadowPad** and activity previously associated with **Red Foxtrot/APT10**. Talos assessed that UAT-7290 appears to serve a dual role: carrying out espionage while also acting as an **initial access provider** that converts compromised devices into **Operational Relay Box (ORB)** nodes for possible use by other China-linked operators. SilentRaid supports modular capabilities such as remote shell access, file management, and port forwarding, while Bulbature was tied to ORB infrastructure through a self-signed certificate observed on at least **141 hosts** in **China or Hong Kong**, reinforcing the attribution assessment.
Jun 29, 2026