Historical intelligence backfill. This assessment covers reporting originally published on 2026-02-05 and was added to the RWP archive on 2026-09-07.
DKnife sits on the router — seven years of AitM, ShadowPad as the payload
Talos 5 February 2026 — China-nexus (high confidence) Linux AitM framework on compromised gateways since at least 2019, C2 still up in early 2026. DNS hijack, DPI, fake updates, ShadowPad/DarkNimbus. Aimed at Chinese-speaking users, not a U.S. grid wiper.
Bottom line up front
CONFIRMED 5 February 2026 Cisco Talos — DKnife, undocumented China-nexus adversary-in-the-middle framework on compromised routers/edge, not on the laptop. Active since at least 2019; C2 reachable into early 2026. Seven Linux (x86-64 ELF) implants: DPI, DNS hijack, redirect, credential harvest. Hijacks updates (including Android/app/AV traffic) to drop ShadowPad and DarkNimbus; lineage with Spellbinder / WizardNet. Talos high confidence China-nexus from Simplified Chinese in configs/comments, China-market app/email logic, and ShadowPad. Primary victimology: Chinese-speaking users. Earth Minotaur overlap reported in secondary write-ups.
ASSESSED If your plant’s internet egress is a cheap Linux router with a default password, this class of implant is how “IT” becomes “everyone’s updates are lying.” That is exposure, not a confirmed ICS incident in the Talos post.
What happened
Own the gateway, rewrite DNS, serve malware as the vendor patch.
Why it matters
EDR on the endpoint never sees the first lie. Certificate pinning and DNS that does not trust the local resolver are the controls.
What is confirmed vs not
CONFIRMED Talos framework, longevity, ShadowPad delivery, China-nexus high.
NOT: a named U.S. CI outage.
What defenders should do
- Treat SOHO/edge Linux as hostile until proven; no default creds, no WAN admin.
- DoH/DoT that bypasses the gateway’s DNS.
- Hunt ShadowPad from “update” paths.
RWP assessment
Confidence: High on Talos. Do not brief DKnife as a 2026 U.S. water-sector campaign.
Historical intelligence backfill. This assessment covers reporting originally published on 2026-02-05 and was added to the RWP archive on 2026-09-07.
Sources
- Cisco Talos — Knife Cutting the Edge DKnife
- CSO — DKnife long-running AitM
- SOC Prime — DKnife gateway AiTM summary