Cybersecurity researchers have taken the wraps off a gateway-monitoring and adversary-in-the-middle (AitM) framework dubbed DKnife that is operated by China-nexus risk actors since a minimum of 2019.
The framework includes seven Linux-based implants which can be designed to carry out deep packet inspection, manipulate visitors, and ship malware by way of routers and edge units. Its main targets appear to be Chinese language-speaking customers, an evaluation primarily based on the presence of credential harvesting phishing pages for Chinese language e-mail companies, exfiltration modules for standard Chinese language cell functions like WeChat, and code references to Chinese language media domains.
“DKnife’s assaults goal a variety of units, together with PCs, cell units, and Web of Issues (IoT) units,” Cisco Talos researcher Ashley Shen famous in a Thursday report. “It delivers and interacts with the ShadowPad and DarkNimbus backdoors by hijacking binary downloads and Android utility updates.”
The cybersecurity firm mentioned it found DKnife as a part of its ongoing monitoring of one other Chinese language risk exercise cluster codenamed Earth Minotaur that is linked to instruments just like the MOONSHINE exploit package and the DarkNimbus (aka DarkNights) backdoor. Curiously, the backdoor has additionally been put to make use of by a 3rd China-aligned superior persistent risk (APT) group known as TheWizards.
An evaluation of DKnife’s infrastructure has uncovered an IP handle internet hosting WizardNet, a Home windows implant deployed by TheWizards by way of an AitM framework known as Spellbinder. Particulars of the toolkit had been documented by ESET in April 2025.
The concentrating on of Chinese language-speaking customers, Cisco mentioned, hinges on the invention of configuration information obtained from a single command-and-control (C2) server, elevating the likelihood that there could possibly be different servers internet hosting related configurations for various regional concentrating on.
That is important in gentle of infrastructural connections between DKnife and WizardNet, as TheWizards is understood to focus on people and the playing sector throughout Cambodia, Hong Kong, Mainland China, the Philippines, and the United Arab Emirates.
 |
| Capabilities of seven DKnife parts |
Not like WizardNet, DKnife is engineered to be run on Linux-based units. Its modular structure allows operators to serve a variety of capabilities, starting from packet evaluation to visitors manipulation. Delivered by way of an ELF downloader, it accommodates seven completely different parts –
- dknife.bin – The central nervous system of the framework liable for deep packet inspection, person actions reporting, binary obtain hijacking, and DNS hijacking
- postapi.bin – A knowledge reporter module that acts as a relay by receiving visitors from DKnife and reporting to distant C2
- sslmm.bin – A reverse proxy module modified from HAProxy that performs TLS termination, e-mail decryption, and URL rerouting
- mmdown.bin – An updater module that connects to a hard-coded C2 server to obtain APKs used for the assault
- yitiji.bin – A packet forwarder module that creates a bridged TAP interface on the router to host and route attacker-injected LAN visitors
- distant.bin – A peer-to-peer (P2P) VPN shopper module that creates a communication channel to distant C2
- dkupdate.bin – An updater and watchdog module that retains the assorted parts alive
“DKnife can harvest credentials from a significant Chinese language e-mail supplier and host phishing pages for different companies,” Talos mentioned. “For harvesting e-mail credentials, the sslmm.bin part presents its personal TLS certificates to purchasers, terminates and decrypts POP3/IMAP connections, and inspects the plaintext stream to extract usernames and passwords.”
“Extracted credentials are tagged with ‘PASSWORD,’ forwarded to the postapi.bin part, and in the end relayed to distant C2 servers.”
The core part of the framework is “dknife.bin,” which takes care of deep packet inspection, permitting operators to conduct visitors monitoring campaigns starting from “covert monitoring of person exercise to lively in-line assaults that exchange respectable downloads with malicious payloads.” This consists of –
- Serving up to date C2 to Android and Home windows variants of DarkNimbus malware
- Conducting Area Identify System (DNS)-based hijacking over IPv4 and IPv6 to facilitate malicious redirects for JD.com-related domains
- Hijacking and changing Android utility updates related to Chinese language information media, video streaming, picture modifying apps, e-commerce platforms, taxi-service platforms, gaming, and pornography video streaming apps by intercepting their replace manifest requests
- Hijacking Home windows and different binary downloads primarily based on sure pre-configured guidelines to ship by way of DLL side-loading the ShadowPad backdoor, which then masses DarkNimbus
- Interfering with communications from antivirus and PC-management merchandise, together with 360 Complete Safety and Tencent companies
- Monitoring person exercise in real-time and reporting it again to the C2 server
“Routers and edge units stay prime targets in refined focused assault campaigns,” Talos mentioned. “As risk actors intensify their efforts to compromise this infrastructure, understanding the instruments and TTPs they make use of is crucial. The invention of the DKnife framework highlights the superior capabilities of contemporary AitM threats, which mix deep‑packet inspection, visitors manipulation, and customised malware supply throughout a variety of machine varieties.”
