Understanding Knight Ransomware: Advisory, Analysis

CloudSEK analysts report on Knight (aka Cyclops 2.0), a Golang-based multi-platform ransomware-as-a-service that combines data exfiltration and encryption (ChaCha20+AES256), provides a Tor-hosted affiliate builder/panel and stealer module, assigns per-target domains and automated payment/decryption workflows, and is actively recruiting affiliates while claiming links to other ransomware groups.