Are there any known cases of malware in the wild that utilize port knocking on a backdoor to evade detection by network scanners?
Sebastein Jeanquier's Master's thesis section 7.1, "Port Knocking in Malware (Backdoors)", states that SAdoor and its predecessor cd00r both used this feature.
Tony Bradley writes in About.com that "malware writers of the world have unfortunately ... begun to adopt this technique for opening backdoors on victimized systems" but doesn't provide any examples.
I don't think there are any--back in '99, one of the early botnet tools called Stacheldraht contained some pretty awesome crypto features; but soon after that, malware authors realized that infosec people hardly ever review their firewall logs, and stopped trying to hide or secure their command and control channels. These days, they mostly just use plaintext IRC for C&C.