# Akira Ransomware Attack Collapses 158-Year-Old UK Logistics Firm KNP (Knights of Old) After Guessed Employee Password

> In June 2023, the Akira ransomware group got into the systems of KNP Logistics Group, a 158-year-old Northamptonshire haulier that traded as Knights of Old, by guessing an employee's weak password. The attackers encrypted company data and destroyed servers, backups and disaster-recovery systems. KNP lost critical systems and financial information, could not secure new funding, and entered administration: about 730 staff were made redundant and roughly 500 lorries were taken off the road.

- **Published:** 2026-10-21T18:00:18Z
- **Last reviewed:** 2026-10-21T18:00:18Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4051
- **ID:** TL-2026-4051
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** TRACKING
- **Actor:** Akira
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2023-20269

## Description

KNP Logistics Group was one of the UK's largest privately owned logistics groups. It traded under the KNP, Knights of Old, Nelson Distribution, Steve Porter Transport and Merlin Supply Chain Solutions brands, ran a fleet of about 500 trucks, and reported turnover of GBP 94.5m in the year to 31 May 2022. In June 2023 it suffered a ransomware attack that BBC Panorama ("Fighting Cyber Criminals", aired 21 July 2025) attributed to the Akira ransomware gang. Former director Paul Abbott told the BBC the attackers got in by guessing an employee's password. Reporting based on the Panorama investigation says the password was simple enough to be identified manually, without brute-force tooling or phishing. Abbott said he had not told the employee whose password was likely compromised.

Once inside, the actors encrypted company data and locked staff out of internal systems. Motor Transport reports that the actors also destroyed servers, backups and disaster-recovery systems, so the logistics network could not operate. The ransom note opened with Akira's standard text: "If you're reading this it means the internal infrastructure of your company is fully or partially dead." Cyber specialists quoted by the BBC estimated the demand at up to GBP 5 million (Akira's typical opening demand is cited as about USD 5m, with an average negotiated payout of about USD 2m). Sources disagree on payment. Halcyon's summary states that KNP paid but access was not restored. BBC-derived reporting (Trans.info, Container News) states the company could not afford the ransom. The primary BBC account points to non-payment, and the Halcyon claim should be treated as uncorroborated. KNP held cyber insurance and complied with industry IT standards, but those controls did not prevent the loss.

According to administrators FRP Advisory (joint administrator Raj Mittal), the attack hit key systems, processes and financial information. That damaged the group's financial position and its ability to secure investment and funding. Just before administration, the directors sold Nelson Distribution (Belper, Derbyshire; 117 vehicles; about 170 staff transferred under TUPE) to Kinaxia Logistics. Knights of Old, KNP Logistics Group, Steve Porter Transport and Merlin Supply Chain Solutions all entered administration, and about 730 employees were made redundant.

Akira context (CISA/FBI advisory AA24-109A, April 2024, updated November 2025): Akira was first observed in March 2023, only about three months before the KNP intrusion. The group mainly gains access through VPN and remote-access services without multi-factor authentication, using brute-force, password-spraying and credential-stuffing attacks and stolen credentials. It has also exploited Cisco ASA/FTD flaws (CVE-2020-3259, CVE-2023-20269) and SonicWall CVE-2024-40766. In August 2023, Cisco confirmed that Akira was targeting Cisco ASA VPNs not configured for MFA. After access, Akira operators commonly do the following:
- Discovery with AdFind, Advanced IP Scanner and SoftPerfect NetScan.
- Credential theft with Mimikatz (LSASS dumping), LaZagne and Veeam credential-extraction scripts (VeeamHax.exe, Veeam-Get-Creds.ps1).
- Remote access with AnyDesk, LogMeIn and RustDesk.
- Exfiltration with Rclone, FileZilla, WinSCP and Ngrok before encryption (double extortion).
- Shadow-copy deletion with powershell.exe -Command "Get-WmiObject Win32_Shadowcopy | Remove-WmiObject".

The 2023-era Windows encryptor used ChaCha (2008 implementation) with RSA-4096 key wrapping and partial file encryption. It appended .akira and dropped akira_readme.txt. Avast/Gen Digital released a free decryptor for that early variant in June 2023. The Rust-based Megazord variant (.powerranges, from August 2023) and Akira_v2 (Linux/ESXi) followed. The KNP-specific forensic indicators (hashes, IPs, the exact compromised service) have not been published. The IOCs in this record are Akira family indicators from CISA AA24-109A and threat-tracker sources, provided for hunting and detection, not as artifacts recovered from KNP. CISA reports Akira's claimed proceeds at about USD 244.17 million as of late September 2025.

Defensive takeaways:
- Enforce MFA on every externally reachable authentication surface (VPN, RDP gateways, webmail, remote-access tools).
- Apply password-strength and banned-password policies, and monitor for low-and-slow password guessing as well as high-volume brute force.
- Keep offline or immutable backups, and segregate backup-server credentials (Veeam), which Akira specifically targets.
- Alert on shadow-copy deletion, mass file renames to .akira or .powerranges, and staging of Rclone, WinSCP or AnyDesk.

## MITRE ATT&CK

- T1110.001 Brute Force: Password Guessing
- T1078 Valid Accounts
- T1133 External Remote Services
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1047 Windows Management Instrumentation
- T1003.001 OS Credential Dumping: LSASS Memory
- T1555 Credentials from Password Stores
- T1087.002 Account Discovery: Domain Account
- T1018 Remote System Discovery
- T1046 Network Service Discovery
- T1219 Remote Access Tools
- T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
- T1048 Exfiltration Over Alternative Protocol
- T1490 Inhibit System Recovery
- T1485 Data Destruction
- T1657 Financial Theft

## Sources

- [Ransomware Shuts Down 158-Year-Old UK Logistics Firm (Halcyon, Anthony M. Freed)](https://www.halcyon.ai/blog/ransomware-shuts-down-158-year-old-uk-logistics-firm)
- [Employee's weak password opened door to Knights of Old cyber attackers, BBC documentary reveals (Motor Transport)](https://motortransport.co.uk/operator-news/employees-weak-password-opened-door-to-knights-of-olds-cyber-attackers-bbc-documentary-reveals/26654.article)
- [Ransomware attack sinks 158-year-old transport firm (Container News)](https://container-news.com/ransomware-attack-sinks-158-year-old-transport-firm)
- [Cyberattack destroys 158-year-old UK haulier KNP (Trans.info)](https://trans.info/en/cyberattack-uk-415161)
- [Cyber attack pushes KNP Logistics into administration with loss of 730 jobs (Motor Transport)](https://motortransport.co.uk/cyber-attack-pushes-knp-logistics-into-administration-with-loss-of-730-jobs/5454.article)
- [Kinaxia buys Nelson Distribution as parent company KNP Logistics files for administration (Motor Transport)](https://motortransport.co.uk/kinaxia-buys-nelson-distribution-as-parent-company-knp-logistics-files-for-administration/9721.article)
- [CISA/FBI #StopRansomware: Akira Ransomware (AA24-109A, updated 13 Nov 2025)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-109a)
- [Decrypted: Akira Ransomware (Avast / Gen Digital)](https://www.gendigital.com/blog/insights/research/decrypted-akira-ransomware)
- [Akira ransomware notes and Tor infrastructure (RansomLook)](https://www.ransomlook.io/notes/akira)
- [CVE-2023-20269: Akira Ransomware Exploits Cisco ASA Vulnerability (Picus Security)](https://picussecurity.com/resource/blog/cve-2023-20269-akira-ransomware-exploits-cisco-asa-vulnerability)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4051