Cybersecurity researchers have taken the wraps off a gateway-monitoring and adversary-in-the-middle (AitM) framework dubbed DKnife that is operated by China-nexus risk actors since at the least 2019.
The framework contains seven Linux-based implants which might be designed to carry out deep packet inspection, manipulate visitors, and ship malware by way of routers and edge units. Its major targets appear to be Chinese language-speaking customers, an evaluation primarily based on the presence of credential harvesting phishing pages for Chinese language e mail providers, exfiltration modules for widespread Chinese language cellular purposes like WeChat, and code references to Chinese language media domains.
“DKnife’s assaults goal a variety of units, together with PCs, cellular units, and Web of Issues (IoT) units,” Cisco Talos researcher Ashley Shen famous in a Thursday report. “It delivers and interacts with the ShadowPad and DarkNimbus backdoors by hijacking binary downloads and Android utility updates.”
The cybersecurity firm stated it found DKnife as a part of its ongoing monitoring of one other Chinese language risk exercise cluster codenamed Earth Minotaur that is linked to instruments just like the MOONSHINE exploit package and the DarkNimbus (aka DarkNights) backdoor. Curiously, the backdoor has additionally been put to make use of by a 3rd China-aligned superior persistent risk (APT) group known as TheWizards.
An evaluation of DKnife’s infrastructure has uncovered an IP handle internet hosting WizardNet, a Home windows implant deployed by TheWizards by way of an AitM framework known as Spellbinder. Particulars of the toolkit had been documented by ESET in April 2025.
The focusing on of Chinese language-speaking customers, Cisco stated, hinges on the invention of configuration information obtained from a single command-and-control (C2) server, elevating the chance that there may very well be different servers internet hosting comparable configurations for various regional focusing on.
That is important in mild of infrastructural connections between DKnife and WizardNet, as TheWizards is thought to focus on people and the playing sector throughout Cambodia, Hong Kong, Mainland China, the Philippines, and the United Arab Emirates.
 |
| Features of seven DKnife parts |
Not like WizardNet, DKnife is engineered to be run on Linux-based units. Its modular structure permits operators to serve a variety of features, starting from packet evaluation to visitors manipulation. Delivered via an ELF downloader, it comprises seven completely different parts –
- dknife.bin – The central nervous system of the framework liable for deep packet inspection, person actions reporting, binary obtain hijacking, and DNS hijacking
- postapi.bin – A knowledge reporter module that acts as a relay by receiving visitors from DKnife and reporting to distant C2
- sslmm.bin – A reverse proxy module modified from HAProxy that performs TLS termination, e mail decryption, and URL rerouting
- mmdown.bin – An updater module that connects to a hard-coded C2 server to obtain APKs used for the assault
- yitiji.bin – A packet forwarder module that creates a bridged TAP interface on the router to host and route attacker-injected LAN visitors
- distant.bin – A peer-to-peer (P2P) VPN shopper module that creates a communication channel to distant C2
- dkupdate.bin – An updater and watchdog module that retains the assorted parts alive
“DKnife can harvest credentials from a serious Chinese language e mail supplier and host phishing pages for different providers,” Talos stated. “For harvesting e mail credentials, the sslmm.bin part presents its personal TLS certificates to shoppers, terminates and decrypts POP3/IMAP connections, and inspects the plaintext stream to extract usernames and passwords.”
“Extracted credentials are tagged with ‘PASSWORD,’ forwarded to the postapi.bin part, and in the end relayed to distant C2 servers.”
The core part of the framework is “dknife.bin,” which takes care of deep packet inspection, permitting operators to conduct visitors monitoring campaigns starting from “covert monitoring of person exercise to energetic in-line assaults that change professional downloads with malicious payloads.” This consists of –
- Serving up to date C2 to Android and Home windows variants of DarkNimbus malware
- Conducting Area Title System (DNS)-based hijacking over IPv4 and IPv6 to facilitate malicious redirects for JD.com-related domains
- Hijacking and changing Android utility updates related to Chinese language information media, video streaming, picture enhancing apps, e-commerce platforms, taxi-service platforms, gaming, and pornography video streaming apps by intercepting their replace manifest requests
- Hijacking Home windows and different binary downloads primarily based on sure pre-configured guidelines to ship by way of DLL side-loading the ShadowPad backdoor, which then masses DarkNimbus
- Interfering with communications from antivirus and PC-management merchandise, together with 360 Whole Safety and Tencent providers
- Monitoring person exercise in real-time and reporting it again to the C2 server
“Routers and edge units stay prime targets in subtle focused assault campaigns,” Talos stated. “As risk actors intensify their efforts to compromise this infrastructure, understanding the instruments and TTPs they make use of is vital. The invention of the DKnife framework highlights the superior capabilities of contemporary AitM threats, which mix deep‑packet inspection, visitors manipulation, and customised malware supply throughout a variety of system sorts.”
