City of Defiance hit by Knight Ransomware

The City of Defiance has been hit by a cyberattack claimed by the Knight ransomware group. The City of Defiance data breach was first brought to light on December 13, 2023, when Knight officially listed the City of Defiance as their latest target.

Knight ransomware group active since August 2023, follows the disturbing trend of employing double extortion tactics that involve encrypting files on victims’ machines and exfiltrating sensitive data for extortion purposes.

The threat actor revealed their malicious intent on the dark web, declaring, “DEFIANCE, a great place to live.” The dark web post indicated that the attackers had successfully breached the city’s internal network, gaining access to over 390 gigabytes of sensitive data.

Among the compromised files were employee records, law enforcement videos, emails, and various confidential documents, including contracts.

With a population of 17,066 as per the 2020 census, the city now faces the fallout of a cyber incident that has put its residents and infrastructure at risk.

This disclosure included a countdown on the dark web, with a promise to reveal download links at the end of the ticking clock. The City of Defiance’s contact information, including its address and phone number, was also disclosed, adding an unsettling dimension to the cyber threat.

Knight’s predecessor, Cyclops, was equipped with multi-OS tools for Windows, Linux, and Mac OS. While the investigation has currently identified a Windows version of the Knight ransomware, there is a looming concern that other versions tailored for different operating systems may be in development.

Knight has been previously involved in phishing campaigns targeting Italian organizations that leveraged malicious email attachments, a tactic reminiscent of an advisory issued by CERT Italy in early September.