China-Linked DKnife Spyware Hijacking Internet Routers Since 2019 - Cybernoz - Cybersecurity News

China-Linked DKnife Spyware Hijacking Internet Routers Since 2019 - Cybernoz - Cybersecurity News

The central hubs of our online lives, internet routers and edge devices, have become the primary targets of a long-running spying operation. Researchers at Cisco Talos recently shared details about a toolkit named DKnife that has been compromising these gateway devices since at least 2019. By embedding itself into the hardware that connects internal networks to the wider web, this malware can watch, record, and even change the data passing throu…

DKnife targets network gateways in long running AitM campaign

A previously undocumented China-linked adversary-in-the-middle (AitM) framework known as “DKnife” has been identified operating at network gateways, where it intercepts and manipulates in-transit traffic. According to Cisco Talos’ findings, the framework has been active since at least 2019 and remains operational as of early 2026. Rather than targeting endpoints directly, DKnife is deployed at the network edge, giving operators visibility into a…