THREAT ACTOR
KNIGHT_
DormantKNIGHT is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of KNIGHT, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2024 15
- 2023 39
Leak site mirrors
6 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
knight3xppu263m7g4ag3xlit2qxpryjwueobh7vjdc3zrscqlfu3pqd.onionBlog snapshot · 2024-02-14 08:16 -
3r7zqtidvujbmfhx52sb34u4vwkh66baefmqzlbqpcnwm3krzipy37yd.onionsnapshot · 2024-12-10 04:34 -
uzfrntnmwojla5v4w3xvpxerjg43kuzqxmtspqhi5qclwtof5ibgonyd.onionsnapshot · 2024-12-11 09:46 -
r6chas4skrvna72fg5ui3cqkke4fnpinsskvlo57aiolrrdb3r777mqd.onionsnapshot · 2024-12-11 09:46 -
vdyummkrwpjg5ufzefpsqlei5jgfulgci42fjraslavxeegsodei2tyd.onionsnapshot · 2024-12-11 09:46 -
apem3txac4a74co33eceffd3yrfsufhebdzjc5zvjlie53wius2gbtyd.onionsnapshot · 2025-04-14 13:20
Recent victims
The 50 most recent victims claimed by KNIGHT. Total in the index: 54.
| Date listed | Victim | Description |
|---|---|---|
| 2024-02-08 | DHX–Dependable Hawaiian Express | DHX–Dependable Hawaiian Express20 GB of accounting documents were stol… |
| 2024-02-05 | GRUPO SCA（Release of all data) | https://www.gruposca.com/historia/Release of all dataEnjoy:http://uzfr… |
| 2024-02-04 | GRUPO SCA（Release of all data in 20 hours) | https://www.gruposca.com/historia/Release of all data in 20 hoursEnjoy… |
| 2024-02-03 | FEPCO Zona Franca SAS | we have +100GB of confidential data, bank contracts, invoices, custome… |
| 2024-02-02 | AbelSantosyAsociados | We'll provide a sample of the data. Enjoy:http://uzfrntnmwojla5v4w3xvp… |
| 2024-01-31 | CityDfDefiance(Disclosure of all) | Because of their lack of cooperation, we had to release all the data, … |
| 2024-01-31 | GRUPO SCA（Latest disclosure of 20Gb) | https://www.gruposca.com/historia/In view of your non-cooperation, we … |
| 2024-01-31 | DIROX LTDA (Vietnã) | Dirox is a proven turn-key digital solution partner with 20 years of e… |
| 2024-01-29 | Chamber of Deputies of Romania (Camera Deputaților din România) | We have obtained more than size of 250,000 MB … |
| 2024-01-29 | ABECOM LTDA | We have more than 170 GB of confidential ABECOM company files, contrac… |
| 2024-01-14 | cityofdefiance.com(leaking) | We have obtained more than 390Gb files on their internal network, whic… |
| 2024-01-14 | GRUPO SCA(leaking) | https://www.gruposca.com/historia/We got over 100Gb of data from their… |
| 2024-01-07 | Agro Baggio LTDA | Apparently, the DPO/LGPD rules that Agro Baggio holds so dear are not … |
| 2024-01-06 | GRUPO SCA | https://www.gruposca.com/historia/We got over 100Gb of data from their… |
| 2024-01-06 | www.gruposca.com | We got over 100Gb of data from their network, containing their confide… |
| 2023-12-16 | Crace Medical Centre | https://www.cracemc.com.au/30 GB of data. We wait you in the chat.Phon… |
| 2023-12-13 | cityofdefiance.com | We have obtained more than 390Gb files on our internal network, which … |
| 2023-12-08 | DAIHO INDUSTRIAL Co.,Ltd. | Daiho_Logo.png 41.64 KBSince its foundation in 1937, the Daiho Group h… |
| 2023-12-08 | Akir Metal San Tic Ltd ti was hacked. All confidential information was stolen | Who is akir Metal San Tic Ltd tiAkım Metal produces metal parts in Ist… |
| 2023-11-30 | Contitec Empresarial | https://www.contitec.net.br/ *250GB OF STOLEN DATA* … |
| 2023-11-30 | Wakefield & Associates | www.wakeassoc.com We have over 400GB of data from Wakefield and A… |
| 2023-11-29 | Studio D.EL.LA. SRL | http://www.studiodella.it/150GB STEALED.A Trieste si trova lo studio D… |
| 2023-11-29 | Dreyfuss Williams & Associates Co., LPA | Domain:www.dreyfuss.com300GB+ of data has been downloaded from Dreyfus… |
| 2023-11-29 | FUTURA Fundamentsysteme was hacked | ALL THE CRITICAL DOCUMENTS WERE STOLENAbout FUTURA FundamentsystemeHea… |
| 2023-11-01 | US Claims Solutions | Over 600GB of sensitive data were stolen from there. US CLAIMS S… |
| 2023-10-30 | Faieta Motorcompany IT | https://faietamoto.it/FAIETA MOTORS: CONCESSIONARIO UFFICIALE YAMAHAFa… |
| 2023-10-30 | Mario de Cecco - Workwear & Corporate Wear IT | https://www.dececco.net/50 Anni di successi di famigliaLa nostra stori… |
| 2023-10-30 | Kinesis Film Srl | https://www.kinesisfilm.it/Kinesis srl è una società di produzione ind… |
| 2023-10-30 | BMW Munique Motors | https://www.bmwmuniquemotors.com.br/Bem-vindo à página oficial da Muni… |
| 2023-10-30 | Benefit Management | As a result of our hack attack the network has been encrypted and over… |
| 2023-10-30 | Intellipop Fiber Internet | Intellipop is a locally owned Internet Service Provider located in Pay… |
| 2023-10-30 | il Centro | https://www.ilcentro.it/Il Centro è il quotidiano d'Abruzzo. Il suo pr… |
| 2023-10-30 | Emmea Srl | https://www.emmeasrl.it/Emmea srl, nasce nel 1999 con l’intenzione di … |
| 2023-10-30 | Michels Markisen GmbH | Michels Markisen SaunabauAnders sein – Handwerk, Menschen, Ideen im Fo… |
| 2023-10-30 | Pontifica Universidad Católica de Chile | https://www.uc.cl/ (ALL DATA ENCRYPTED)La Pontificia Universidad Catól… |
| 2023-10-30 | Veneto Transportes | http://www.venetolog.com.br/A Vêneto Transportes é uma operadora logís… |
| 2023-10-13 | Hospital Italiano de Buenos Aires | El Hospital Italiano de Buenos Aires es una asociación civil sin fines… |
| 2023-10-13 | AKBASOGLU HOLDING Trans KA | This blog will be published in 3 days and all data will be made public… |
| 2023-10-10 | National Health Mission. Department of Health & Family Welfare, Govt. of U.P | Patient status and Data Website: https://upnrhm.gov.in/Home/Index |
| 2023-10-10 | National Health Mission. Department of Heath & Family Welfare, Govt. of U.P | Patient status and Data Website: https://upnrhm.gov.in/Home/Index |
| 2023-10-10 | Guhring was hacked. Thousands of confidential files stolen. | This blog will be published 72 hours after the attack, all data will b… |
| 2023-10-03 | GDL Logística Integrada S.A | Who is GDL Logistica Integrada S.A? Rodovia Governador Mario Covas, 8… |
| 2023-09-29 | Garn Mason Orthodontics was hacked. All insurance and personal data of customers was stole | Garn Mason Orthodontics was hacked. All insurance and personal data of… |
| 2023-09-25 | Nusmiles Hospital | https://www.nusmiles.com/ nusmiles is a general dentist specializing i… |
| 2023-09-19 | Hacketts printing services | As a family business, we have thrived and adapted over the last 68 yea… |
| 2023-09-18 | Dustin J Will LCC / Dustin J Will Sole MBR | Dustin J Will LCC / Dustin J Will Sole MBR 47-49497xx Wealth Strategie… |
| 2023-09-18 | Lopez & Associates Inc | Lopez & Associates Inc. photocopy service remains one of California's … |
| 2023-09-14 | etsi.uy | Victim refuses to cooperate in negotiations and make efforts to pay an… |
| 2023-09-13 | Benefit Management INC | Before start running the encryption to your servers and computers , w… |
| 2023-09-13 | Tanachira Group | Tanachira's mission is to inspire and celebrate designs of world famou… |
CONFIRMED ATTACKS
Knight confirmed attacks: 6 verified incidents
Ransomnews has verified 6 Knight incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from September 2023 to January 2024. United States accounts for 2 of them (33%), with victims recorded in 5 countries in total. The most affected sector is government, at 2 confirmed victims. A ransom payment was publicly confirmed in 0 cases and publicly refused in 2; the outcome is unrecorded in the remaining 4.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Knight incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| January 2024 | Camera Deputaţilor | Government | Bucharest, Romania | — | No | Source |
| December 2023 | Crace Medical Centre | Healthcare | Crace, Australia | — | Unknown | Source |
| November 2023 | City of Defiance | Government | Ohio, United States | — | Unknown | Source |
| October 2023 | Capgemini | Technology | Paris, France | — | No | Source |
| October 2023 | Pontificia Universidad Catolica de Chile | Education | Santiago, Chile | — | Unknown | Source |
| September 2023 | Benefit Management Corporation | Finance | Nebraska, United States | — | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Knight's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.