DKnife
DKnife is a modular Linux-based gateway-monitoring and adversary-in-the-middle (AitM) malware framework discovered by Cisco Talos and assessed with high confidence to be operated by China-nexus threat actors since at least 2019, with command-and-control infrastructure still active as of January 2026. It is designed to compromise routers and edge devices and consists of seven Linux ELF implants, including dknife.bin, postapi.bin, sslmm.bin, yitiji.bin, remote.bin, mmdown.bin, and dkupdate.bin. The framework performs deep-packet inspection, DNS hijacking, traffic manipulation, reverse proxying, TLS termination, credential harvesting, phishing, malware delivery, VPN-based remote access, and component updating/persistence.
Talos reported that DKnife targets routers and edge devices running Linux-based firmware and can affect downstream PCs, mobile devices, and IoT devices by manipulating traffic at the gateway. Observed capabilities include hijacking Windows binary downloads and Android application updates, forging HTTP 302 redirects for files such as .exe, .rar, .zip, and .apk, intercepting Android update manifests and returning forged JSON responses, and serving malicious payloads from a local attacker-controlled interface at 10.3.3.3 created by yitiji.bin. The framework also decrypts POP3 and IMAP over TLS to extract usernames and passwords from at least one major Chinese email provider, hosts phishing pages, forwards harvested credentials labeled PASSWORD to remote C2 servers, and monitors user activity including WeChat, Signal, voice/video calls, text messages, shopping, news, maps, gaming, dating, rideshare requests, and email checks. Talos also observed DKnife disrupting antivirus and PC-management traffic, including 360 Total Security and Tencent-related domains, by sending crafted TCP RST packets.
DKnife has been used to deliver the ShadowPad and DarkNimbus backdoors by intercepting Windows binary downloads and Android app updates. Talos found an install.exe payload with SHA-256 2550aa4c4bc0a020ec4b16973df271b81118a7abea77f77fec2f575a32dc3444 in the DKnife archive; it was a RAR self-extracting package containing ShadowPad and DarkNimbus components. In one observed chain, TosBtKbd.exe sideloaded TosBtKbd.dll, which then loaded the DarkNimbus DLL TosBtKbdLayer.dll. Talos also reported that delivered DarkNimbus samples contacted 1.1.1.1 and DKnife intercepted that request to provide the real C2 IP. ShadowPad samples delivered by DKnife were reported as signed with certificates issued to 四川奇雨网络科技有限公司 in Chengdu, Sichuan, China.
The framework shows strong China-focused targeting. Talos cited Simplified Chinese code comments, configuration language, telemetry labels, a default China Telecom IMSI value, code references to Chinese media domains, and modules tailored for Chinese mail services, WeChat, and numerous Chinese-language mobile applications. Talos found 185 JSON files under /bin/html/dkay-scripts configured to hijack Android applications, mostly targeting popular Chinese-language services. Although observed targeting was primarily Chinese-speaking users, Talos noted infrastructure and tradecraft overlap with WizardNet and the Spellbinder AitM framework, suggesting shared development or operational lineage and possible broader regional targeting.
Persistence and infrastructure details directly reported in the content include modification of /etc/rc.local with commands inserted between #startdianke and #enddianke markers, use of /dksoft/conf/server.conf, /dksoft/conf/rules.aes, and /dksoft/html/app/, and hardcoded/default URLs including http://47.93.54[.]134:8005, https://47.93.54[.]134:8003, http://117.175.185[.]81:8003/, and host 43.132.205[.]118. The remote.bin component creates a virtual device named edge0 and joins a hardcoded community named dknife. Talos also published detection references including ClamAV signatures Win.Trojan.Shadowpad-10010830-1, Win.Loader.WizardNet-10044819-0, Win.Trojan.DarkNimbus-10059255-0, Win.Trojan.DKnife-10059257-0, Unix.Trojan.DKnife-10059259-0, and Win.Trojan.DKnife-10059260-0, as well as Snort rule 65533.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
A sophisticated gateway-monitoring and adversary-in-the-middle (AitM) framework known as DKnife has been identified, operated by China-nexus threat actors since at least 2019.
A sophisticated gateway-monitoring and adversary-in-the-middle (AitM) framework known as DKnife has been identified, operated by China-nexus threat actors since at least 2019.
"China-Linked DKnife AitM Framework Targets Routers for Traffic Hijacking, Malware Delivery" ... "dubbed DKnife" ... "comprises seven Linux-based implants" designed to "perform deep packet inspection, manipulate traffic, and deliver malware via routers and edge devices."
"The DKnife Linux toolkit represents a significant escalation in adversary-in-the-middle (AitM) threats targeting network infrastructure... engineered to compromise Linux-based routers and edge devices, enabling attackers to intercept, manipulate, and exfiltrate network traffic at the gateway level."
Techniques & procedures
28 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
6 techniques
Initial Access
"...begins with the compromise of a Linux-based router or edge device, either via... credential reuse (T1078)..."
"...hijacking binary downloads and Android application updates." / "Hijacking and replacing Android application updates... by intercepting their update manifest requests"
DKnife hijacks software downloads and Android app updates... It redirects update requests to a local malicious server and replaces legitimate downloads with malware.
"DKnife toolkit abuses routers to spy and deliver malware since 2019"
Execution
1 technique
Execution
Persistence
4 techniques
Persistence
The code establishes persistence by modifying the /etc/rc.local file, a script commonly used to execute commands and scripts after the system boots and initializes services.
"...begins with the compromise of a Linux-based router or edge device, either via... credential reuse (T1078)..."
For the Android variants, the backdoor attempts to contact a Baidu URL "http[:]//fanyi.baidu[.]com/query_config_dk" to retrieve its C2 information. This URL does not return any response from Baidu itself; rather, it serves as a recognizable trigger for DKnife, which intercepts the request and injects the C2 response.
Privilege Escalation
3 techniques
Privilege Escalation
The code establishes persistence by modifying the /etc/rc.local file, a script commonly used to execute commands and scripts after the system boots and initializes services.
Stealth
4 techniques
Stealth
The tool loads encrypted hijacking rules, decrypts them with a QQ TEA–based key, and deletes them after use.
"...begins with the compromise of a Linux-based router or edge device, either via... credential reuse (T1078)..."
For the Android variants, the backdoor attempts to contact a Baidu URL "http[:]//fanyi.baidu[.]com/query_config_dk" to retrieve its C2 information. This URL does not return any response from Baidu itself; rather, it serves as a recognizable trigger for DKnife, which intercepts the request and injects the C2 response.
Credential Access
5 techniques
Credential Access
DKnife inspects traffic to monitor and report user’s network activity to its remote C2 in real time.
The malware also steals credentials by intercepting encrypted email connections and hosting phishing pages.
“The toolkit… steals credentials from Chinese services”
Discovery
1 technique
Discovery
Collection
2 techniques
Collection
Command and Control
8 techniques
Command and Control
When an HTTP request’s Host and URI match the configured rule, DKnife evaluates the rule’s duration and interval timers to determine whether to trigger. If the rule fires and the requested filename has a matching extension (e.g., “.exe”, “.rar”, “.zip”, or “.apk”), DKnife forges an HTTP 302 redirect whose Location URL is taken from the rule’s data field.
This component acts as the reverse proxy server for the AitM attack and is implemented as a pre-configured, customized build of HAProxy.
"sslmm.bin - A reverse proxy module modified from HAProxy that performs TLS termination..."
After creating the folders for DKnife deployment, the downloader fetches the DKnife archive from the C2 and launches every binary in /dksoft/bin/ using nohup [filepath] 2>/dev/null 1>/dev/null &.
For the Android variants, the backdoor attempts to contact a Baidu URL "http[:]//fanyi.baidu[.]com/query_config_dk" to retrieve its C2 information. This URL does not return any response from Baidu itself; rather, it serves as a recognizable trigger for DKnife, which intercepts the request and injects the C2 response.
Exfiltration
2 techniques
Exfiltration
Postapi.bin loads the configuration file server.conf to obtain the address of the remote C2 server used for data exfiltration... The component uses libcurl to send different types of exfiltrated and reporting data via HTTP POST requests to specific API endpoints.
Impact
1 technique
Impact
IOCs tracked for this family
21 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
DKnife toolkit abuses routers to spy and deliver malware since 2019
Gateway-monitoring/AitM framework comprising multiple Linux-based implants for deep packet inspection, traffic manipulation, and malware delivery via routers/edge devices.
A China-nexus gateway-monitoring/AitM framework composed of seven Linux implants that perform deep-packet inspection, manipulate network traffic, and can deliver malware via routers and edge devices.
Linux-based modular AitM/gateway-monitoring framework deployed on routers/edge devices to perform deep packet inspection, manipulate network traffic, harvest credentials (e.g., by decrypting POP3/IMAP), conduct DNS hijacking/redirection, and hijack downloads/updates to deliver additional malware.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.