Inactive ransomware operator
← All groupsKnight
48 victims indexed · first seen 3 years ago · last activity 2 years ago
At a glance
- Status
- inactive
- First seen
- 3 years ago
- Last activity
- 2 years ago
- Onion sites
- 3 known endpoints
- Primary sector
- Healthcare · 6 hits
About
References
4 linksExternal sources curated by the MISP threat-intel community.
Timeline
6 monthsTop countries
Top sectors
MITRE ATT&CK
40 techniques · 12 tacticsTactics
Techniques
- T1003.001LSASS Memory
- T1005Data from Local System
- T1007System Service Discovery
- T1018Remote System Discovery
- T1027.001Binary Padding
- T1027.003Steganography
- T1036Masquerading
- T1036.002Right-to-Left Override
- T1036.005Match Legitimate Resource Name or Location
- T1039Data from Network Shared Drive
- T1053.002At
- T1053.005Scheduled Task
- T1059.001PowerShell
- T1059.003Windows Command Shell
- T1059.005Visual Basic
- T1059.006Python
- T1070.004File Deletion
- T1071.001Web Protocols
- T1080Taint Shared Content
- T1083File and Directory Discovery
- T1087.002Domain Account
- T1102.001Dead Drop Resolver
- T1105Ingress Tool Transfer
- T1113Screen Capture
- T1124System Time Discovery
- T1132.001Standard Encoding
- T1140Deobfuscate/Decode Files or Information
- T1189Drive-by Compromise
- T1203Exploitation for Client Execution
- T1204.002Malicious File
- T1518Software Discovery
- T1547.001Registry Run Keys / Startup Folder
- T1548.002Bypass User Account Control
- T1550.003Pass the Ticket
- T1560.001Archive via Utility
- T1566.001Spearphishing Attachment
- T1573.001Symmetric Cryptography
- T1574.001DLL
- T1588.002Tool
- T1685Disable or Modify Tools
Recent victims
Loading…
Onion infrastructure
3 known- http://knight3xppu263m7g4ag3xlit2qxpryjwueobh7vjdc3zrscqlfu3pqd.onion
- http://knight3xppu263m7g4ag3xlit2qxpryjwueobh7vjdc3zrscqlfu3pqd.onion/search/
- http://nt3rrzq5hcyznvdkpslvqbbc2jqecqrinhi5jtwoae2x7psqtcb6dcad.onion
Source
Updated 2 years agoData on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.
