Knight Ransomware Report

Overview

Cyclops ransomware, which has recently rebranded as Knight, is a multi -platform malware that targets Windows, macOS, and Linux operating systems. Knight operates as a Ransomware-as-a-Service (RaaS) provider, offering both ransomware and information-stealing capabilities. In June 2023, the Cyclops ransomware was detected to have been rebranded as an enhanced rendition, named ‘Knight’, the key upgraded feature being an update to the lite encryptor to support a batch distribution of the malware2. A new data leak site was also launched.

Knight ransomware operators have been observed offering an information stealer malware that captures sensitive data from infected hosts within the attack chain of the ransomware deployment. The group has also been involved in double-extortion tactics, threatening to leak stolen data to pressure victims into paying the ransom. The ransomware encrypts files using advanced encryption algorithms, rendering them inaccessible until a ransom is paid3. The malware is distributed through various channels, including hacker forums and the Cyclops/Knight administrator panel. The malware shares similarities with other ransomware families like Babuk and LockBit.

Impact

Successful exploitation by Knight ransomware will almost certainly result in the encryption and exfiltration of significant quantities of data held on the compromised system, prior to a ransom of a predetermined value being issued. The ransom amount demanded will almost certainly depend on the estimated value of the compromised organisation. Furthermore, such a compromise of data will also result in the organisation incurring a negative reputational impact.

Encrypted data may include private customer data, corporate finance data and system credentials that if released can assist threat actors with future attacks.

Incident Detection

A comprehensive endpoint detection and response (EDR) solution, such as Microsoft Defender, can provide additional protection against ransomware threats like that implemented by Knight ransomware. EDR solutions can alert system users of potential breaches and stop further progress before the malware can do significant damage.

If an EDR solution is not being utilised, the first instance of detection is likely to be the Knight ransom note, an example of which has been provided below.