Ransomware
Knight (predecessor)Cyclops (predecessor)Cyclops 2.0
Attribution
Financially motivated ransomware-as-a-service (RaaS) operation of unconfirmed nationality. Operators are believed to be Russian-speaking cybercriminals; the group's rules reportedly prohibited affiliates from targeting CIS countries, Cuba, North Korea, and China, a convention common among Russia-nexus RaaS crews. No confirmed state sponsorship. Attribution to a specific individual or country is unproven.
Motivation
Financial gain via double-extortion (data encryption plus exfiltration and threatened leak on a Tor data-leak site).
Attribution confidence
medium
MENA targeting
UAE, Saudi Arabia, Egypt, Lebanon
Sectors
Manufacturing, energy/utilities, government/defense, professional services, technology
Corpus activity · 6mo1 mention
Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.
Why it mattersRansomware actor, medium confidence, documented targeting UAE, Saudi Arabia, Egypt (Manufacturing, energy/utilities, government/defense sectors).
What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.
No open hunts or recent alerts tracked against this actor right now.