Back Gbhackers

China

Gbhackers •Mayura Kathir • February 6, 2026

“DKnife,” a sophisticated gateway-monitoring and adversary-in-the-middle (AitM) framework that turns Linux-based routers and edge devices into surveillance tools. Active since at least 2019, this campaign employs seven distinct Linux implants to inspect network traffic, hijack legitimate software downloads, and deploy advanced malware. The framework remains active as of January 2026, targeting personal computers, mobile phones, […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Discovery of DKnife Malware Framework Linked to MOONSHINE Exploit Kit Cisco Talos researchers discovered a previously hidden malware framework named DKnife while hunting for samples of the DarkNimbus backdoor associated with the MOONSHINE exploit kit. This framework, which features gateway monitoring and adversary-in-the-middle capabilities, was found to communicate with the same command and control server as DarkNimbus. The findings were detailed in a report published on February 5, 2026. 11 sources 39

Extracted Entities

China

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Countries (1)

Platforms (1)