Threat reportRansomwareTL-2026-4051
Akira Ransomware Attack Collapses 158-Year-Old UK Logistics Firm KNP (Knights of Old) After Guessed Employee Password
Akira Ransomware Attack Collapses 158-Year-Old UK Logistics (TL-2026-4051), also tracked as Knights of Old ransomware attack, is a high-severity ransomware operation, first published 2026-10-21. It is attributed to Akira with high confidence, affects KNP Logistics Group Corporate IT estate (KNP, Knights of Old, Nelson, references 1 CVE (CVE-2023-20269), maps to 16 MITRE ATT&CK techniques (T1003.001, T1018, T1046), and is covered by 9 detection rules and 26 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 16MITRE ATT&CK
- Actors
- 1Akira
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 26Indicators of compromise
Key facts for TL-2026-4051
- Threat ID
- TL-2026-4051
- Also known as
- Knights of Old ransomware attack, KNP Logistics ransomware attack
- Severity
- HIGH
- Status
- TRACKING
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution
- Akira
- Attribution confidence
- HIGH
- Motivation
- FINANCIAL
- Target sectors
- transport, logistics
- Target regions
- united kingdom, Europe
- Detection rules
- 9
- Indicators of compromise
- 26
Malware and tooling in Akira Ransomware Attack Collapses 158-Year-Old UK Logistics
Malware and tooling: Akira, Akira _v2 - S1194, Megazord - S1191, MimiKatz, AdFind - S0552, Advanced IP Scanner, AnyDesk, LaZagne - S0349, Mimikatz, Rclone - S1040, WinSCP
How Akira Ransomware Attack Collapses 158-Year-Old UK Logistics works
In June 2023, the Akira ransomware group got into the systems of KNP Logistics Group, a 158-year-old Northamptonshire haulier that traded as Knights of Old, by guessing an employee's weak password. The attackers encrypted company data and destroyed servers, backups and disaster-recovery systems. KNP lost critical systems and financial information, could not secure new funding, and entered administration: about 730 staff were made redundant and roughly 500 lorries were taken off the road.
KNP Logistics Group was one of the UK's largest privately owned logistics groups. It traded under the KNP, Knights of Old, Nelson Distribution, Steve Porter Transport and Merlin Supply Chain Solutions brands, ran a fleet of about 500 trucks, and reported turnover of GBP 94.5m in the year to 31 May 2022. In June 2023 it suffered a ransomware attack that BBC Panorama ("Fighting Cyber Criminals", aired 21 July 2025) attributed to the Akira ransomware gang. Former director Paul Abbott told the BBC the attackers got in by guessing an employee's password. Reporting based on the Panorama investigation says the password was simple enough to be identified manually, without brute-force tooling or phishing. Abbott said he had not told the employee whose password was likely compromised.
Once inside, the actors encrypted company data and locked staff out of internal systems. Motor Transport reports that the actors also destroyed servers, backups and disaster-recovery systems, so the logistics network could not operate. The ransom note opened with Akira's standard text: "If you're reading this it means the internal infrastructure of your company is fully or partially dead." Cyber specialists quoted by the BBC estimated the demand at up to GBP 5 million (Akira's typical opening demand is cited as about USD 5m, with an average negotiated payout of about USD 2m). Sources disagree on payment. Halcyon's summary states that KNP paid but access was not restored. BBC-derived reporting (Trans.info, Container News) states the company could not afford the ransom. The primary BBC account points to non-payment, and the Halcyon claim should be treated as uncorroborated. KNP held cyber insurance and complied with industry IT standards, but those controls did not prevent the loss.
According to administrators FRP Advisory (joint administrator Raj Mittal), the attack hit key systems, processes and financial information. That damaged the group's financial position and its ability to secure investment and funding. Just before administration, the directors sold Nelson Distribution (Belper, Derbyshire; 117 vehicles; about 170 staff transferred under TUPE) to Kinaxia Logistics. Knights of Old, KNP Logistics Group, Steve Porter Transport and Merlin Supply Chain Solutions all entered administration, and about 730 employees were made redundant.
Akira context (CISA/FBI advisory AA24-109A, April 2024, updated November 2025): Akira was first observed in March 2023, only about three months before the KNP intrusion. The group mainly gains access through VPN and remote-access services without multi-factor authentication, using brute-force, password-spraying and credential-stuffing attacks and stolen credentials. It has also exploited Cisco ASA/FTD flaws (CVE-2020-3259, CVE-2023-20269) and SonicWall CVE-2024-40766. In August 2023, Cisco confirmed that Akira was targeting Cisco ASA VPNs not configured for MFA. After access, Akira operators commonly do the following: - Discovery with AdFind, Advanced IP Scanner and SoftPerfect NetScan. - Credential theft with Mimikatz (LSASS dumping), LaZagne and Veeam credential-extraction scripts (VeeamHax.exe, Veeam-Get-Creds.ps1). - Remote access with AnyDesk, LogMeIn and RustDesk. - Exfiltration with Rclone, FileZilla, WinSCP and Ngrok before encryption (double extortion). - Shadow-copy deletion with powershell.exe -Command "Get-WmiObject Win32_Shadowcopy | Remove-WmiObject".
The 2023-era Windows encryptor used ChaCha (2008 implementation) with RSA-4096 key wrapping and partial file encryption. It appended .akira and dropped akira_readme.txt. Avast/Gen Digital released a free decryptor for that early variant in June 2023. The Rust-based Megazord variant (.powerranges, from August 2023) and Akira_v2 (Linux/ESXi) followed. The KNP-specific forensic indicators (hashes, IPs, the exact compromised service) have not been published. The IOCs in this record are Akira family indicators from CISA AA24-109A and threat-tracker sources, provided for hunting and detection, not as artifacts recovered from KNP. CISA reports Akira's claimed proceeds at about USD 244.17 million as of late September 2025.
Defensive takeaways: - Enforce MFA on every externally reachable authentication surface (VPN, RDP gateways, webmail, remote-access tools). - Apply password-strength and banned-password policies, and monitor for low-and-slow password guessing as well as high-volume brute force. - Keep offline or immutable backups, and segregate backup-server credentials (Veeam), which Akira specifically targets. - Alert on shadow-copy deletion, mass file renames to .akira or .powerranges, and staging of Rclone, WinSCP or AnyDesk.
MITRE ATT&CK techniques used in TL-2026-4051
Credential Access
T1003.001 OS Credential Dumping: LSASS Memory; T1110.001 Brute Force: Password Guessing; T1555 Credentials from Password Stores
Discovery
T1018 Remote System Discovery; T1046 Network Service Discovery; T1087.002 Account Discovery: Domain Account
Execution
T1047 Windows Management Instrumentation; T1059.001 Command and Scripting Interpreter: PowerShell
Exfiltration
T1048 Exfiltration Over Alternative Protocol; T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
Initial Access
T1078 Valid Accounts; T1133 External Remote Services
Command and Control
Impact
T1485 Data Destruction; T1490 Inhibit System Recovery; T1657 Financial Theft
Affected products and versions in Akira Ransomware Attack Collapses 158-Year-Old UK Logistics
- KNP Logistics Group — Corporate IT estate (KNP, Knights of Old, Nelson Distribution, Steve Porter Transport, Merlin Supply Chain Solutions)
Vulnerable versions: Single-factor password-authenticated employee account (June 2023) - Microsoft — Windows (Akira Windows encryptor and Megazord variant targets)
Vulnerable versions: All Windows hosts reachable with compromised domain credentials - VMware — ESXi / Linux (Akira_v2 encryptor targets)
Vulnerable versions: Hypervisors reachable by Akira operators
Remediation for Akira Ransomware Attack Collapses 158-Year-Old UK Logistics
Patches
- Patch Cisco ASA/FTD for CVE-2020-3259 and CVE-2023-20269 (Akira-exploited VPN flaws)
- Patch SonicWall SonicOS for CVE-2024-40766 (Akira-exploited)
- Keep Veeam Backup & Replication patched against credential-exposure flaws used by Akira tooling
Immediate actions
- Enforce phishing-resistant MFA on all VPN, RDP gateway, remote-access and webmail logins; Akira primarily targets single-factor VPN access
- Reset any weak, default or reused passwords and block known-weak passwords with a banned-password list
- Hunt for the Akira indicators: akira_readme.txt / fn.txt ransom notes, .akira / .powerranges / .akiranew / .aki file extensions, and the CISA AA24-109A hashes
- Alert on and block the shadow-copy deletion command powershell.exe -Command "Get-WmiObject Win32_Shadowcopy | Remove-WmiObject" and vssadmin delete shadows
- Check for unauthorized AnyDesk, LogMeIn, RustDesk, Rclone, WinSCP, FileZilla and Ngrok installs and for AdFind or Advanced IP Scanner execution
- Isolate backup infrastructure (especially Veeam servers) and rotate backup-service credentials
Workarounds
- Limit VPN and remote access to managed devices and allow-listed source ranges where possible
- Set account lockout and rate limiting on VPN and remote-access authentication
- Disable or restrict unused remote-access software and PowerShell for standard users through application control
- For early-2023 Windows Akira infections (.akira extension), evaluate the free Avast/Gen Digital Akira decryptor (NoMoreRansom) before considering payment
Longer-term hardening
- Keep offline, immutable and regularly restore-tested backups and disaster-recovery copies on credentials separate from the production domain
- Monitor authentication logs for low-volume password guessing and logins from unusual geographies or hosting providers, not just high-volume brute force
- Segment the network so one compromised user account cannot reach backup, hypervisor and DR systems
- Adopt a recognized baseline such as NCSC Cyber Essentials and run regular independent security audits (former KNP director Paul Abbott advocated an 'MOT' for IT systems)
- Maintain and exercise a ransomware incident-response and business-continuity plan that assumes total loss of primary IT
- Review cyber-insurance coverage against realistic total-outage scenarios; KNP was insured and still collapsed
CVEs associated with Akira Ransomware Attack Collapses 158-Year-Old UK Logistics
Weaknesses (CWE) in Akira Ransomware Attack Collapses 158-Year-Old UK Logistics
Timeline of Akira Ransomware Attack Collapses 158-Year-Old UK Logistics
- Akira ransomware activity is first observed in March 2023 (exact day not stated; CISA AA24-109A).
- In June 2023 (exact day not disclosed), Akira actors access KNP Logistics Group by guessing an employee's weak password, then encrypt data and destroy servers, backups and disaster-recovery systems. The ransom demand is estimated at up to GBP 5m.
- Avast/Gen Digital releases a free decryptor for the early Windows Akira variant (.akira extension, ChaCha 2008 + RSA-4096 partial encryption).
- In August 2023, Akira begins deploying the Rust-based Megazord encryptor (.powerranges extension). The same month, Cisco confirms Akira is targeting Cisco ASA VPNs not configured for MFA through brute-force and credential-stuffing attacks.
- Kinaxia Logistics acquires Nelson Distribution (Belper, 117 vehicles, about 170 staff under TUPE) in a deal completed by the directors just before administration.
- Motor Transport reports that KNP Logistics Group, Knights of Old, Steve Porter Transport and Merlin Supply Chain Solutions have entered administration under FRP Advisory, with about 730 redundancies. Administrators cite the June 2023 ransomware attack's damage to key systems, processes and financial information.
- CISA, FBI, Europol EC3 and the Netherlands NCSC publish joint advisory AA24-109A on Akira TTPs and IOCs.
- BBC Panorama's "Fighting Cyber Criminals" airs. Former KNP director Paul Abbott confirms Akira got in by guessing an employee password. Halcyon and trade press publish follow-up coverage the same day.
- CISA updates AA24-109A with Akira activity through 2025, including SonicWall CVE-2024-40766 exploitation, Nutanix AHV targeting and about USD 244.17m in claimed proceeds.
Sources cited for Akira Ransomware Attack Collapses 158-Year-Old UK Logistics
- Ransomware Shuts Down 158-Year-Old UK Logistics Firm (Halcyon, Anthony M. Freed)
- Employee's weak password opened door to Knights of Old cyber attackers, BBC documentary reveals (Motor Transport)
- Ransomware attack sinks 158-year-old transport firm (Container News)
- Cyberattack destroys 158-year-old UK haulier KNP (Trans.info)
- Cyber attack pushes KNP Logistics into administration with loss of 730 jobs (Motor Transport)
- Kinaxia buys Nelson Distribution as parent company KNP Logistics files for administration (Motor Transport)
- CISA/FBI #StopRansomware: Akira Ransomware (AA24-109A, updated 13 Nov 2025)
- Decrypted: Akira Ransomware (Avast / Gen Digital)
- Akira ransomware notes and Tor infrastructure (RansomLook)
- CVE-2023-20269: Akira Ransomware Exploits Cisco ASA Vulnerability (Picus Security)
Detection coverage for TL-2026-4051
As of 2026-10-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4051 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.