Knight

Knight is a ransomware operation/group active by at least early 2024. The provided reporting states that Knight sold its source code in February 2024. Multiple sources in the content link Knight to later ransomware ecosystem developments: RansomHub is described as a suspected successor to Knight, and ESET states that RansomHub’s encryptor was built from repurposed Knight source code rather than written from scratch. Additional reporting notes links between RansomHub, ALPHV/BlackCat, and the former Knight ransomware group due to significant code overlap. Dragos observed Knight among ransomware groups affecting industrial organizations, with Knight accounting for 1.9% of incidents in the cited period (four incidents). High-confidence details in the provided content about Knight’s own technical behavior, infection vectors, targeted platforms, industries, or specific IOCs are otherwise not available.