{
  "name": "Knife Cutting the Edge: Disclosing a China-nexus gateway-monitoring AitM framework",
  "slug": "knife-cutting-the-edge-disclosing-a-china-nexus-gateway-monitoring-aitm-framework",
  "description": "Cisco Talos uncovered 'DKnife', a sophisticated gateway-monitoring and adversary-in-the-middle (AitM) framework comprising seven Linux-based implants. Used since 2019, DKnife performs deep-packet inspection, traffic manipulation, and malware delivery via routers and edge devices. It targets various devices, including PCs, mobile devices, and IoT, delivering ShadowPad and DarkNimbus backdoors. The framework primarily targets Chinese-speaking users, with evidence suggesting China-nexus threat actors as operators. DKnife's capabilities include DNS hijacking, Android application update hijacking, Windows binary hijacking, anti-virus traffic disruption, and user activity monitoring. A link to the WizardNet campaign was also discovered, indicating a shared development or operational lineage.",
  "published": "2026-02-05T19:16:27+00:00",
  "created_at": "2026-02-05T19:16:27+00:00",
  "modified_at": "2026-02-06T15:58:37+00:00",
  "created_at_opencti": "2026-02-05T19:16:27+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2026-02-05",
    "aitm",
    "china-nexus",
    "darknimbus",
    "dknife",
    "dns hijacking",
    "gateway-monitoring",
    "poisonplug.shadow",
    "shadowpad",
    "traffic manipulation",
    "wizardnet"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "110.92.64.17"
      },
      {
        "id": "",
        "name": "60.205.148.180"
      },
      {
        "id": "",
        "name": "47.93.54.134"
      },
      {
        "id": "",
        "name": "43.155.62.54"
      },
      {
        "id": "",
        "name": "89.195.5.18"
      },
      {
        "id": "",
        "name": "117.175.185.81"
      },
      {
        "id": "",
        "name": "110.185.104.180"
      },
      {
        "id": "",
        "name": "47.238.107.83"
      },
      {
        "id": "",
        "name": "110.92.64.117"
      },
      {
        "id": "",
        "name": "49.89.41.187"
      },
      {
        "id": "",
        "name": "61.139.76.99"
      },
      {
        "id": "",
        "name": "210.56.49.72"
      },
      {
        "id": "",
        "name": "https://47.93.54.134:8003/protocol/virtual-id"
      },
      {
        "id": "",
        "name": "https://47.93.54.134:8003/protocol/application"
      },
      {
        "id": "",
        "name": "https://47.93.54.134:8003/"
      },
      {
        "id": "",
        "name": "http://43.155.62.54:81/app/minibrowser11_rpl.zip"
      },
      {
        "id": "",
        "name": "https://47.93.54.134:8003/protocol/attack-result"
      },
      {
        "id": "",
        "name": "https://49.89.41.187:8002/protocol/virtual-id"
      },
      {
        "id": "",
        "name": "https://47.93.54.134:8003/protocol/packet-up"
      },
      {
        "id": "",
        "name": "http://89.195.5.18:4553"
      },
      {
        "id": "",
        "name": "http://110.92.64.17/moo.cgi"
      },
      {
        "id": "",
        "name": "http://43.132.205.118:81/app/minibrowser11_rpl.zip"
      },
      {
        "id": "",
        "name": "https://47.93.54.134:8003/protocol/user-account"
      },
      {
        "id": "",
        "name": "https://47.93.54.134:8003"
      },
      {
        "id": "",
        "name": "http://47.93.54.134:8005"
      },
      {
        "id": "",
        "name": "https://47.93.54.134:8003/protocol/channel-trigger-log"
      },
      {
        "id": "",
        "name": "http://47.238.107.83:81/app/minibrowser11_rpl.zip"
      },
      {
        "id": "",
        "name": "http://110.185.104.180:8000"
      },
      {
        "id": "",
        "name": "https://49.89.41.187:8002/protocol/application"
      },
      {
        "id": "",
        "name": "https://49.89.41.187:8001/protocol/target-info"
      },
      {
        "id": "",
        "name": "https://47.93.54.134:8003/protocol/internet-action"
      },
      {
        "id": "",
        "name": "https://47.93.54.134:8003/protocol/tcp-data"
      },
      {
        "id": "",
        "name": "https://47.93.54.134:8001/protocol/call-audio"
      },
      {
        "id": "",
        "name": "https://47.93.54.134:8003/public/bind-ip"
      },
      {
        "id": "",
        "name": "http://47.93.54.134:8005/"
      },
      {
        "id": "",
        "name": "https://49.89.41.187:8002/protocol/tcp-data"
      },
      {
        "id": "",
        "name": "https://47.93.54.134:8003/protocol/target-info"
      },
      {
        "id": "",
        "name": "http://117.175.185.81:8003/"
      },
      {
        "id": "",
        "name": "http://49.89.41.187:8003/"
      },
      {
        "id": "",
        "name": "https://49.89.41.187:8002/"
      },
      {
        "id": "",
        "name": "aee2021cdff5536013368cf5ce14222823c5c0dd6d95074992f78a4ca9fae0be"
      },
      {
        "id": "",
        "name": "1ea6667496eeb94755dafd75cd4755e0efb93c916e52921f66edc5c21c876a82"
      },
      {
        "id": "",
        "name": "67f28e05f120a28eab40f588abfce7bc7e76d2c7126f5bc93ab0feb74d9b12f5"
      },
      {
        "id": "",
        "name": "2ebb7ae49b47934e19413f0deaa8c46e1cf791c776c3ed2c15c3a69511455a02"
      },
      {
        "id": "",
        "name": "02479ed4eab50844cfb0ffa1fee61a4663e4c1713e5ef496f22e519e2de8b2da"
      },
      {
        "id": "",
        "name": "3a024b3dea30e1f563a297343b9c1c80d22f1b2f6844091353b52f34b15498e5"
      },
      {
        "id": "",
        "name": "e35dde281d71e8519493322e5e720fb46f3d32083bdcb2593436c511e5b4b096"
      },
      {
        "id": "",
        "name": "5ab86388bab3c67f7fe741a1179c20a90acc638db79077a8be9cd89ea8069741"
      },
      {
        "id": "",
        "name": "78a425fca23e709e2abe8ddf182f586b58b5ad5880f97d679b86db9322a304f6"
      },
      {
        "id": "",
        "name": "77de39e67354557eed2b61f0bb39128fa67e92da98097f0de9251408c202f22f"
      },
      {
        "id": "",
        "name": "c59509018bbbe5482452a205513a2eb5d86004369309818ece7eba7a462ef854"
      },
      {
        "id": "",
        "name": "a0a8f441be5740e7ddb7fc5fcf5a4db7c7e743f68cbc85b2f5ed932d0817fc46"
      },
      {
        "id": "",
        "name": "94116f358b8efb9b40834609564ae162ba246e40d822d510794ffdda96c85bc5"
      },
      {
        "id": "",
        "name": "d39899b079132e3510ef2d3a21e298ce0776d796c87a0f488c482d60dbbfd626"
      },
      {
        "id": "",
        "name": "17f4f2bda80a4d19c0477165336d5851de1978707286bc5e0f3cef9e7c843ea3"
      },
      {
        "id": "",
        "name": "62368f963bfeeef063250198a314fd9bf541794cd86c097c19300765cb617ab9"
      },
      {
        "id": "",
        "name": "08f57ad20eabe6b1f294ff4ac3045a97ae872361944f4fb079964d3801dc7c4d"
      },
      {
        "id": "",
        "name": "c0fbbdec744b46df7ea9ad638b016e1d6ef6554046eabfd75cbd17a9cbe4424b"
      },
      {
        "id": "",
        "name": "9ed358c8bd05081491f9e6d460dc3c3f4300e52689ea8e8a5b2971d805ff047a"
      },
      {
        "id": "",
        "name": "58d00cc6552b53da178b121851391e74646d636b171ac7c5cbd9350bcfc02f57"
      },
      {
        "id": "",
        "name": "2550aa4c4bc0a020ec4b16973df271b81118a7abea77f77fec2f575a32dc3444"
      },
      {
        "id": "",
        "name": "247b739f4098bb31bf1899ceb43144ff39a1473d2f696e595ce7cddfcc3ba816"
      },
      {
        "id": "",
        "name": "290d267bf8da5c0e19c2d4480654ce5de18a54f01d87c7d2916df31e59883bf5"
      },
      {
        "id": "",
        "name": "f818c74cbf88bb2a8c79650fb2bdfa6e9a9bd38d58a3433e37756da7d981a130"
      },
      {
        "id": "",
        "name": "40ac46a116b65f0450acc2673dc0d973b6df83b6f5260e4cba049f0fd008c9fb"
      },
      {
        "id": "",
        "name": "43891d3898a54a132d198be47a44a8d4856201fa7a87f3f850432ba9e038893a"
      },
      {
        "id": "",
        "name": "2d47e2551fa4daaf5375699a86a06ecbc51943ecf097c4fbcc68a9de136f043a"
      },
      {
        "id": "",
        "name": "f8d01dca76b9028611369b956d9d1a7f89729df01a6a86d46a9db9fdab1decca"
      },
      {
        "id": "",
        "name": "ce0530aae6283fa1f82926603eec1f349606d0325d1f6174273d6d5866982f0b"
      },
      {
        "id": "",
        "name": "c643190784b4b2ad06d1c909e59f4b6164c59128cb69eb20b948f5533a7d1ef7"
      },
      {
        "id": "",
        "name": "233bdbfadebb532f2730bd965795302bfcd84cb0ccf788c039bac9632b46d957"
      },
      {
        "id": "",
        "name": "e42bf15159b920cf21b016beadf23c6d96c5698107451f47fc25a324815c3810"
      },
      {
        "id": "",
        "name": "7fd78d8a7f635c178b64683e19a7f5a284d1f7cf88a2195f854a21817279fd69"
      },
      {
        "id": "",
        "name": "12afe49dfbe38657eb7eaae79f758be5906bc2c35bd160c5baf942bb142794f7"
      },
      {
        "id": "",
        "name": "9d592198b73c45f08b76cdd6c45611a7bccf0f13975f02f2dde779590339e5d9"
      },
      {
        "id": "",
        "name": "21b995c9df5e54c2f4464c3caa9211dd1db2679add6239e0b5ee79136796a1c8"
      },
      {
        "id": "",
        "name": "5ffbb0996165efbf6797e21ac2dd3ac7370ba766ee7865855c94cda594ae55c0"
      },
      {
        "id": "",
        "name": "9aeb63685404f3f7432aa349272b887dbe4ddba074fc6eb1ff76e8569fc37a08"
      },
      {
        "id": "",
        "name": "b08e83b7467b0ad9d15cab33e21e3db0b5994d918b2c14ca93e6983bd1566085"
      },
      {
        "id": "",
        "name": "17a2dd45f9f57161b4cc40924296c4deab65beea447efb46d3178a9e76815d06"
      }
    ],
    "malware": [
      {
        "id": "legacy:malware:9446bcde9eb2125b",
        "name": "ShadowPad",
        "slug": "shadowpad"
      },
      {
        "id": "2deacfdc-3d59-43b5-9eed-00569228e6b9",
        "name": "DarkNimbus",
        "slug": "darknimbus"
      },
      {
        "id": "6eb1e541-4ae8-42dd-87c4-197534c82ca3",
        "name": "ShadowPad - S0596",
        "slug": "shadowpad-s0596"
      },
      {
        "id": "d80d301f-c4ba-481d-9b7c-b9cad531bff0",
        "name": "WizardNet",
        "slug": "wizardnet"
      }
    ],
    "intrusion_sets": [
      {
        "id": "e62c53a2-f33c-4855-8143-625544812879",
        "name": "China-nexus threat actors",
        "slug": "china-nexus-threat-actors"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "China"
      },
      {
        "id": "",
        "name": "Telecommunications"
      },
      {
        "id": "",
        "name": "240e:a03:a03:303:a03:303:a03:303"
      },
      {
        "id": "",
        "name": "ad.scgawj.com"
      }
    ]
  },
  "external_refs": [
    "https://otx.alienvault.com/pulse/6984fa9b481e11f8426b9eb0",
    "https://blog.talosintelligence.com/knife-cutting-the-edge/"
  ]
}