004

Cisco Talos researchers uncovered DKnife, a modular Linux-based gateway AitM framework operated by China-nexus actors that uses seven implants to perform deep packet inspection, TLS termination, DNS hijacking, credential harvesting, binary and Android update hijacking, and delivery of ShadowPad and DarkNimbus backdoors. Targeting routers and edge devices, DKnife intercepts and manipulates traffic to harvest credentials (including Chinese email providers), replace legitimate downloads and app updates, exfiltrate data from popular Chinese apps, and relay activity summaries to remote C2, indicating a sophisticated, targeted campaign against Chinese-speaking users and regional targets.