DKnife: The Sophisticated Linux Attack Framework Targeting Routers and IoT Devices

Cybersecurity researchers have uncovered a highly advanced attack framework known as DKnife, designed to compromise Linux-based devices, including routers, edge devices, PCs, and IoT systems. Active since at least 2019, DKnife operates with alarming sophistication, performing real-time network traffic manipulation, deep packet inspection (DPI), and delivering malware to unsuspecting targets. Its ongoing operations, confirmed through active command-and-control (C2) servers as of January 2026, highlight the persistent and evolving nature of modern cyber threats.

DKnife is an adversary-in-the-middle (AitM) framework that relies on seven distinct Linux implants, each performing specialized functions to compromise devices. Its operations include hijacking application updates on Android and Windows, deploying backdoors such as ShadowPad and DarkNimbus, and establishing remote access to steal sensitive information. Researchers from Talos Intelligence discovered significant links between DKnife and the WizardNet backdoor, previously associated with another AitM framework called Spellbinder, suggesting potential shared infrastructure or operational collaboration.

One of DKnife’s most notable characteristics is its targeted approach toward Chinese-speaking users. The framework harvests credentials from Chinese-language services and exfiltrates data from widely used applications such as WeChat. Configuration files also reference Chinese media domains, reinforcing the likelihood of China-based threat actors. However, the campaign’s reach is not limited to China. Evidence suggests a broader regional impact, affecting countries like the Philippines, Cambodia, and the UAE, particularly through components connected to WizardNet.

The framework heavily relies on deep packet inspection (DPI) and DNS hijacking to manipulate communications between compromised devices and legitimate websites. This enables attackers to intercept and alter Android application update requests, replacing them with malicious versions that deliver backdoors to devices without raising suspicion. DKnife also hijacks Windows binary downloads, redirecting or replacing legitimate installers with malware-laden files. This dual capability allows the framework to target both individual users and organizations efficiently, silently compromising sensitive information.

By combining traffic hijacking, malware delivery, and data extraction, DKnife represents a new level of cyberattack sophistication. Its operations underscore the urgent need for organizations to monitor routers, edge devices, and network infrastructure closely, ensuring early detection and mitigation against these evolving threats.

What Undercode Say:

DKnife is a prime example of the modern evolution of targeted cyberattack frameworks, where attackers no longer focus solely on conventional PCs but exploit network infrastructure and IoT devices as entry points. Its use of multiple Linux implants demonstrates a modular design philosophy, allowing attackers to adapt their methods depending on the target environment. This modularity also makes attribution difficult, as the same tools can serve multiple campaigns.

The connection between DKnife and WizardNet indicates a growing trend in threat actor collaboration, where frameworks share resources, malware, and infrastructure to maximize efficiency. This challenges traditional cybersecurity models that treat attacks as isolated events; instead, defenders must consider cross-campaign intelligence sharing to anticipate future threats.

DKnife’s targeting of Chinese-speaking users, particularly through applications like WeChat, shows a highly tailored approach. This localization suggests not only operational sophistication but also in-depth research into regional user habits, app ecosystems, and potential vulnerabilities. Attackers harvesting credentials and exfiltrating sensitive data through popular apps highlight the continued risk of supply-chain and software update attacks.

The framework’s DPI and DNS hijacking capabilities elevate its threat level. By intercepting legitimate traffic and substituting malicious content, DKnife avoids detection from traditional antivirus software, which often relies on file signatures rather than network behavior. The ability to compromise both Android and Windows updates underscores the importance of monitoring update channels, not just endpoint devices.

DKnife also reflects the convergence of cyber espionage and cybercrime tactics. While it can deliver ransomware or backdoors for theft, its data exfiltration techniques suggest espionage capabilities targeting government, corporate, and regional networks. This dual-use potential raises the stakes for national cybersecurity strategies.

Organizations operating in Asia and the Middle East should prioritize network segmentation, traffic analysis, and DNS monitoring, as these measures can help detect abnormal traffic indicative of DPI-based attacks. Regular audits of update servers and supply-chain integrity checks are also essential to prevent hijacked software distribution.

DKnife’s persistence since 2019 highlights the long-term nature of advanced threats. Even with active C2 servers identified, the continued operation suggests that threat actors maintain backup infrastructure and constantly update malware components, making eradication extremely difficult. This persistence underscores the need for proactive threat intelligence sharing and collaborative defense mechanisms across industries.

The emergence of DKnife also serves as a warning: as IoT devices proliferate, they are increasingly targeted not just for botnets but for sophisticated espionage campaigns. Security for routers, smart appliances, and other edge devices must no longer be considered secondary but integral to cybersecurity strategy.

In summary, DKnife exemplifies how modern cyber threats combine technological sophistication with social engineering and regional targeting. Its operational design allows attackers to silently infiltrate networks, manipulate updates, and exfiltrate data, often without triggering traditional detection systems. Organizations worldwide must adopt adaptive defenses that monitor both endpoints and network traffic to mitigate such persistent threats.

Fact Checker Results:

✅ DKnife has been active since 2019 and continues to operate in 2026.
✅ It targets Linux-based devices, including IoT, routers, and PCs.
✅ Evidence confirms focus on Chinese-language services and potential regional expansion.

Prediction:

🌐 DKnife’s modular design and cross-framework links suggest it will continue evolving, targeting both IoT and enterprise networks.
⚠️ Expect attackers to increasingly exploit software update mechanisms, not just endpoints.
🔒 Organizations that strengthen DNS monitoring and supply-chain security will likely detect and mitigate DKnife-style attacks more effectively in the next 12–18 months.