Cybersecurity researchers have taken the wraps off a gateway-monitoring and adversary-in-the-middle (AitM) framework dubbed DKnife that is operated by China-nexus menace actors since no less than 2019.
The framework includes seven Linux-based implants which might be designed to carry out deep packet inspection, manipulate visitors, and ship malware by way of routers and edge gadgets. Its major targets appear to be Chinese language-speaking customers, an evaluation primarily based on the presence of credential harvesting phishing pages for Chinese language e mail companies, exfiltration modules for common Chinese language cellular purposes like WeChat, and code references to Chinese language media domains.
“DKnife’s assaults goal a variety of gadgets, together with PCs, cellular gadgets, and Web of Issues (IoT) gadgets,” Cisco Talos researcher Ashley Shen famous in a Thursday report. “It delivers and interacts with the ShadowPad and DarkNimbus backdoors by hijacking binary downloads and Android utility updates.”
The cybersecurity firm stated it found DKnife as a part of its ongoing monitoring of one other Chinese language menace exercise cluster codenamed Earth Minotaur that is linked to instruments just like the MOONSHINE exploit package and the DarkNimbus (aka DarkNights) backdoor. Curiously, the backdoor has additionally been put to make use of by a 3rd China-aligned superior persistent menace (APT) group known as TheWizards.
An evaluation of DKnife’s infrastructure has uncovered an IP handle internet hosting WizardNet, a Home windows implant deployed by TheWizards by way of an AitM framework known as Spellbinder. Particulars of the toolkit had been documented by ESET in April 2025.
The focusing on of Chinese language-speaking customers, Cisco stated, hinges on the invention of configuration recordsdata obtained from a single command-and-control (C2) server, elevating the likelihood that there could possibly be different servers internet hosting comparable configurations for various regional focusing on.
That is vital in gentle of infrastructural connections between DKnife and WizardNet, as TheWizards is understood to focus on people and the playing sector throughout Cambodia, Hong Kong, Mainland China, the Philippines, and the United Arab Emirates.
 |
| Capabilities of seven DKnife elements |
Not like WizardNet, DKnife is engineered to be run on Linux-based gadgets. Its modular structure allows operators to serve a variety of features, starting from packet evaluation to visitors manipulation. Delivered by the use of an ELF downloader, it comprises seven completely different elements –
- dknife.bin – The central nervous system of the framework liable for deep packet inspection, person actions reporting, binary obtain hijacking, and DNS hijacking
- postapi.bin – A knowledge reporter module that acts as a relay by receiving visitors from DKnife and reporting to distant C2
- sslmm.bin – A reverse proxy module modified from HAProxy that performs TLS termination, e mail decryption, and URL rerouting
- mmdown.bin – An updater module that connects to a hard-coded C2 server to obtain APKs used for the assault
- yitiji.bin – A packet forwarder module that creates a bridged TAP interface on the router to host and route attacker-injected LAN visitors
- distant.bin – A peer-to-peer (P2P) VPN shopper module that creates a communication channel to distant C2
- dkupdate.bin – An updater and watchdog module that retains the varied elements alive
“DKnife can harvest credentials from a significant Chinese language e mail supplier and host phishing pages for different companies,” Talos stated. “For harvesting e mail credentials, the sslmm.bin element presents its personal TLS certificates to purchasers, terminates and decrypts POP3/IMAP connections, and inspects the plaintext stream to extract usernames and passwords.”
“Extracted credentials are tagged with ‘PASSWORD,’ forwarded to the postapi.bin element, and in the end relayed to distant C2 servers.”
The core element of the framework is “dknife.bin,” which takes care of deep packet inspection, permitting operators to conduct visitors monitoring campaigns starting from “covert monitoring of person exercise to lively in-line assaults that substitute respectable downloads with malicious payloads.” This contains –
- Serving up to date C2 to Android and Home windows variants of DarkNimbus malware
- Conducting Area Title System (DNS)-based hijacking over IPv4 and IPv6 to facilitate malicious redirects for JD.com-related domains
- Hijacking and changing Android utility updates related to Chinese language information media, video streaming, picture enhancing apps, e-commerce platforms, taxi-service platforms, gaming, and pornography video streaming apps by intercepting their replace manifest requests
- Hijacking Home windows and different binary downloads primarily based on sure pre-configured guidelines to ship by way of DLL side-loading the ShadowPad backdoor, which then hundreds DarkNimbus
- Interfering with communications from antivirus and PC-management merchandise, together with 360 Whole Safety and Tencent companies
- Monitoring person exercise in real-time and reporting it again to the C2 server
“Routers and edge gadgets stay prime targets in refined focused assault campaigns,” Talos stated. “As menace actors intensify their efforts to compromise this infrastructure, understanding the instruments and TTPs they make use of is essential. The invention of the DKnife framework highlights the superior capabilities of contemporary AitM threats, which mix deep‑packet inspection, visitors manipulation, and customised malware supply throughout a variety of machine sorts.”
