Knight
Knight is a ransomware operation/group active by at least early 2024.
Profile source: Mallory opens in a new tabKnight
Family profile
Knight is a ransomware operation/group active by at least early 2024. The provided reporting states that Knight sold its source code in February 2024. Multiple sources in the content link Knight to later ransomware ecosystem developments: RansomHub is described as a suspected successor to Knight, and ESET states that RansomHub’s encryptor was built from repurposed Knight source code rather than written from scratch. Additional reporting notes links between RansomHub, ALPHV/BlackCat, and the former Knight ransomware group due to significant code overlap. Dragos observed Knight among ransomware groups affecting industrial organizations, with Knight accounting for 1.9% of incidents in the cited period (four incidents). High-confidence details in the provided content about Knight’s own technical behavior, infection vectors, targeted platforms, industries, or specific IOCs are otherwise not available.
Ransomware.live
Operational record
Reporting
Research mentioning Knight
First Quarter 2025 Ransomware Trends
"...linked to both the Alphv (BlackCat) ransomware operation and the former Knight ransomware group"
Shifting the sands of RansomHub’s EDRKillShifter
It is also worth mentioning that RansomHub’s encryptor is not written from scratch, but based on repurposed code from Knight, a once-rival ransomware gang that sold its source code in February 2024.
Dragos Industrial Ransomware Analysis: Q4 2023 | Dragos
Cl0p and Knight: 1.9 percent each (4 incidents each)... Dragos observed the following ransomware groups for the first time... Knight
