China-Linked DKnife Spyware Hijacking Internet Routers Since 2019

Cisco Talos uncovers DKnife, a China-nexus framework targeting routers and edge devices. Learn how seven stealthy implants hijack data and deliver malware via AitM attacks.

The central hubs of our online lives, internet routers and edge devices, have become the primary targets of a long-running spying operation. Researchers at Cisco Talos recently shared details about a toolkit named DKnife that has been compromising these gateway devices since at least 2019. By embedding itself into the hardware that connects internal networks to the wider web, this malware can watch, record, and even change the data passing through every connected phone and computer.

According to Cisco Talos’ security researchers, the campaign is remarkably persistent. “The command and control are still active as of January 2026,” they noted, indicating that threat actors are still actively managing their network of compromised devices.

A Digital Hijacker in the Middle

Most of us assume that app ...