Knife Cutting the Edge: Disclosing a China-nexus gateway-monitoring AitM framework

Summary

Cisco Talos uncovered DKnife, a Linux-based gateway-monitoring adversary-in-the-middle framework that tampers with traffic on routers and edge devices across exposed edge appliances while pushing ShadowPad and DarkNimbus backdoors. Active since at least 2019, its command-and-control infrastructure remained reachable into early 2026. DKnife primarily targets Chinese-speaking users and can hijack Android app updates, binary downloads, DNS queries, and even antivirus traffic. The framework is linked to the WizardNet modular backdoor and shares lineage with the Spellbinder AiTM framework.

Investigation

Talos examined ELF implants, configuration files, and network telemetry to map seven main components providing deep-packet inspection, DNS hijacking, traffic redirection, and credential harvesting. Infrastructure review surfaced multiple C2 hosts and ports used to serve malicious “updates.” The research also details how DKnife coordinates with ShadowPad and DarkNimbus, intercepts Baidu update requests, and returns forged responses to victims.

Mitigation

Block known C2 IP addresses and domains, watch for abnormal DNS answers and unusual patterns on router management interfaces, and enforce strict certificate validation to resist TLS interception. Harden router firmware, disable unneeded services, and use network segmentation to constrain lateral movement. Regularly update devices and verify router firmware signatures.

Response

If DKnife is detected, isolate the compromised device, capture memory and network logs, and cut off C2 communication. Perform forensic review of configuration files and retrieved payloads, then clean or re-image the device. Notify affected users and refresh detection signatures with the identified IOCs.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:
  An attacker has deployed the DKnife framework on the compromised host. To establish C2, the framework sends short UDP “beacon” packets to three hard‑coded ports (8005, 555, 5644) on the attacker‑controlled server. The traffic is minimal, contains no payload signatures, and is crafted to blend with typical network management traffic. This matches T1037/T1547 (boot‑time script execution) because the beacon is launched at system start, and T1546.006 as the attacker relies on a “trap” – the firewall rule that watches for this specific port pattern.

• Regression Test Script:

  # DKnife UDP beacon simulation – PowerShell
  $targetIP = "192.0.2.10"   # Replace with C2 server IP
  $ports    = @(8005,555,5644)
  
  foreach ($port in $ports) {
      $udpClient = New-Object System.Net.Sockets.UdpClient
      $payload   = [Text.Encoding]::ASCII.GetBytes("DKnifeBeacon")
      $udpClient.Send($payload, $payload.Length, $targetIP, $port)
      $udpClient.Close()
      Write-Host "Sent beacon to $targetIP:$port"
      Start-Sleep -Seconds 2   # spacing to mimic real beacon cadence
  }

• Cleanup Commands:

  # No persistent changes were made; just ensure no lingering sockets.
  Get-NetUDPEndpoint | Where-Object { $_.LocalPort -in 8005,555,5644 } | Stop-Process -Force
  Write-Host "Cleanup complete – no lingering UDP endpoints."