Security News > 2023 > August > Knight ransomware distributed in fake Tripadvisor complaint emails
The Knight ransomware is being distributed in an ongoing spam campaign that pretends to be TripAdvisor complaints.
Knight ransomware is a recent rebrand of the Cyclop Ransomware-as-a-Service, which switched its name at the end of July 2023.
There are currently no victims or stolen files leaked on the Knight data leak site.
This week, Sophos researcher Felix spotted a new spam campaign pretending to be TripAdvisor complaints but distribute the Knight ransomware instead. While the actual emails were not shared, Felix said that the emails include ZIP file attachments named 'TripAdvisorComplaint.
Enabling the add-in will cause the Knight Lite ransomware encryptor to be injected into a new explorer.
Knight l extension to encrypted files' names, where the 'l' portion likely stands for 'lite.