An ongoing spam campaign has been found distributing the Knight ransomware strain packaged in a file impersonating fake TripAdvisor complaints. Knight is, reportedly, the new version of the already defunct Cyclops ransomware that was launched in May, and currently has no victims listed on its site.
How the campaign works?
- The campaign uses an HTML attachment named ‘TripAdvisor-Complaint-[random].PDF.htm that redirects users to a fake browser window for TripAdvisor.
- This browser window pretends to be a complaint submitted to a restaurant while asking the users to review it.
- Once the user clicks on the ‘Read Complaint’ button, an Excel file named ‘TripAdvisor_Complaint-Possible-Suspension.xll’ is downloaded onto the system, which further causes the execution of the ransomware.
More about Knight's operations
Knight ransomware was first noticed in July after the gang revamped the panel and program of Cyclops ransomware.
- As part of the program, it continues to recruit affiliates on the RAMP hacking forum to enhance its data-stealing ability from Windows and Linux systems.
- In addition to the normal encryptors, the Knight ransomware operation offers a ‘lite’ version to be used in spam, pray-and-spray, and batch distribution campaigns.
Encryption and ransom demand
- The Knight Lite ransomware encryptor, injected into a new explorer.exe process, is used to encrypt the files on targeted computers.
- Upon encryption, the .knight_1 extension is appended to the encrypted files’ names, where ‘1’ stands for lite.
- Then, the ransomware creates a note in each folder on the computer, demanding a ransom of $5,000 to be sent to a the provided Bitcoin address.
Conclusion
Ransomware rebranding is a common technique among cybercriminals seeking ways to expand their monetize their attacks while remaining under the radar. While Knight ransomware is one such recent example, there have been multiple such reports in the past. As this tactic remains prevalent across the ransomware landscape, it is strongly advised to follow the mitigation programs launched by the CISA that can help spot and remediate vulnerabilities exploited in ransomware attacks.
Publisher
/https://cyware-ent.s3.amazonaws.com/image_bank/d021_shutterstock_661733230.jpeg)
/https://cyware-ent.s3.amazonaws.com/image_bank/4004_shutterstock_433319884.jpg)
