Ransomware Roundup – Knight | FortiGuard Labs

On a bi-weekly basis, FortiGuard Labs gathers data on ransomware variants of interest that have been gaining traction within our datasets and the OSINT community. The Ransomware Roundup report aims to provide readers with brief insights into the evolving ransomware landscape and the Fortinet solutions that protect against those variants.

This edition of the Ransomware Roundup covers the Knight ransomware.

Affected platforms: Microsoft Windows
Impacted parties: Microsoft Windows
Impact: Encrypts and exfiltrates victims’ files and demands ransom for file decryption
Severity level: High

Knight Ransomware Overview

Knight is a relatively new ransomware group that arrived in August 2023. Like many attackers, the gang behind this variant employs double extortion tactics, where the Knight ransomware encrypts files on victims’ machines and exfiltrates data for extortion purposes.

The predecessor of Knight, Cyclops, had multi-OS tools for Windows, Linux, and Mac OS. So, while FortiGuard Labs had only located a Windows version of the Knight ransomware at the time of our investigation, it seems likely that other versions may be on the way.

Infection Vector

According to an advisory by CERT Italy in early September, Knight targeted Italian organizations with phishing campaigns using emails with malicious attachments. The same was reported in early August by security researcher @felixw3000. In addition, Remcos and Qakbot malware are known to deliver the Knight ransomware to compromised machines.

Victimology

According to data collected through Fortinet’s FortiRecon service, the Knight ransomware group has targeted multiple industry verticals. While Retail was most affected by the Knight ransomware, the group also victimized organizations in healthcare, including hospitals, physicians’ clinics, and dental offices, indicating that the threat actor has no reservations about impacting people who need medical care.

When classifying victim organizations by country, the United States is in first place by a significant margin.

As of October 20, 2023, the Knight ransomware group had last posted new victims on October 18th.

Knight Ransomware Execution

Once a network has been compromised and data has been exfiltrated, files encrypted by the Knight ransomware are appended with a “.knight_l” file extension.

It then drops a ransom note labeled, “How To Restore Your Files.txt.”

Because the Knight ransomware targets enterprises, the ransom fee is set at a relatively high price. However, the Bitcoin wallet in this ransom note had no recorded transactions at the time of our investigation.

Data Leak Site

The Knight ransomware group owns a TOR site where victims can contact the threat actor. Stolen information and a list of victims are also posted there.

The group also uses another TOR site for disclosing stolen data and has abused several publicly available file-sharing services, such as Mega, Gofile, and UploadNow.

Fortinet Protections

Fortinet customers are already protected from these malware variants through our AntiVirus and FortiEDR services, as follows:

FortiGuard Labs detects the Knight ransomware samples with the following AV signature:

• W64/Filecoder.IZ!tr
• W64/Filecoder.IZ!tr.ransom

FortiGuard Labs detects the known Knight ransomware droppers with the following AV signature:

• W64/Agent.CUP!tr
• W64/Agent.CUO!tr
• W32/Ransom_Win64_CYCLOPS.A
• W32/Ransom.JGNPVEC!tr
• W32/PossibleThreat
• MSIL/Small.DBB!tr.dldr

The FortiGuard AntiVirus service is supported by FortiGate, FortiMail, FortiClient, and FortiEDR. Fortinet EPP customers running current AntiVirus updates are also protected.

Known hosting sites of the Knight ransomware droppers are blocked by the Web filtering client.

IOCs

File IOCs

Network IOCs

FortiGuard Labs Guidance

Due to the ease of disruption, damage to daily operations, potential impact on an organization’s reputation, and the unwanted destruction or release of personally identifiable information (PII), etc., it is vital to keep all AV and IPS signatures up to date.

Since the majority of ransomware is delivered via phishing, organizations should consider leveraging Fortinet solutions designed to train users to understand and detect phishing threats:

The FortiPhish Phishing Simulation Service uses real-world simulations to help organizations test user awareness and vigilance to phishing threats and to train and reinforce proper practices when users encounter targeted phishing attacks.

Our FREE NSE training: NSE 1 – Information Security Awareness includes a module on internet threats designed to help end users learn how to identify and protect themselves from various types of phishing attacks and can be easily added to internal training programs.

Organizations will need to make foundational changes to the frequency, location, and security of their data backups to effectively deal with the evolving and rapidly expanding risk of ransomware. When coupled with digital supply chain compromise and a workforce telecommuting into the network, there is a real risk that attacks can come from anywhere. Cloud-based security solutions, such as SASE, to protect off-network devices; advanced endpoint security, such as EDR (endpoint detection and response) solutions that can disrupt malware mid-attack; and Zero Trust Access and network segmentation strategies that restrict access to applications and resources based on policy and context, should all be investigated to minimize risk and to reduce the impact of a successful ransomware attack.

As part of the industry’s leading fully integrated Security Fabric, delivering native synergy and automation across your security ecosystem, Fortinet also provides an extensive portfolio of technology and human-based as-a-service offerings. These services are powered by our global FortiGuard team of seasoned cybersecurity experts.

Best Practices Include Not Paying a Ransom

Organizations such as CISA, NCSC, the FBI, and HHS caution ransomware victims against paying a ransom partly because the payment does not guarantee that files will be recovered. According to a US Department of Treasury’s Office of Foreign Assets Control (OFAC) advisory, ransom payments may also embolden adversaries to target additional organizations, encourage other criminal actors to distribute ransomware, and/or fund illicit activities that could potentially be illegal. For organizations and individuals affected by ransomware, the FBI has a Ransomware Complaint page where victims can submit samples of ransomware activity via their Internet Crimes Complaint Center (IC3).

How Fortinet Can Help

FortiGuard Labs’ Emergency Incident Response Service provides rapid and effective response when an incident is detected. Our Incident Readiness Subscription Service provides tools and guidance to help you better prepare for a cyber incident through readiness assessments, IR playbook development, and IR playbook testing (tabletop exercises).

Additionally, FortiRecon Digital Risk Protection (DRP), is a SaaS-based service that provides a view of what adversaries are seeing, doing, and planning, to help you counter attacks at the reconnaissance phase and significantly reduce the risk, time, and cost of later-stage threat mitigation.