Skip to main content
Mallory
MalwareRansomwareUsed by 1 actor

Lynx

Lynx is a ransomware family and ransomware-as-a-service (RaaS) operation first observed in mid-2024. Reporting consistently describes it as using double extortion, combining file encryption with data exfiltration and leak-site pressure, although some reporting also notes single-extortion cases. Lynx is widely assessed to be closely related to, a successor to, or possibly a rebrand/spin-off of INC Ransom; multiple sources note significant overlap with INC, including a reported 48% source-code similarity and similar on-chain laundering behavior. Some reporting also notes TTP overlap with historical Nemty, Nemty X, Karma, and Nokoyawa operations.

Functionally, Lynx can encrypt local files, network shares, and mounted or hidden drives, append the .lynx extension to encrypted files, drop a readme.txt ransom note, and use victim portals, public blogs, leak pages, and Tor-based chat infrastructure for negotiations and coercion. Reported capabilities include terminating processes and services that may interfere with encryption, stopping dependent services via Windows APIs, deleting shadow copies and backup-related artifacts to hinder recovery, selectively encrypting specified files/directories/network shares via command-line options, setting a ransom note as wallpaper, and printing ransom notes to connected printers. Acronis reported the analyzed Lynx sample as a PE32 encryptor using AES with ECC-derived keying; Rapid7 reported Base64-obfuscated ransom-note content embedded in the binary and identified hardcoded infrastructure including lynxblog[.]net and multiple .onion victim/leak URLs.

Observed and reported initial access vectors include phishing emails, exploitation of public-facing or unpatched internet-facing systems, compromised or purchased credentials, and use by affiliates recruited on Russian-language underground forums. Reporting also places Lynx among ransomware families observed following an "EDR killer -> ransomware" sequence. CERT Intrinsec observed Lynx among ransomware families used in French intrusions in 2025, where ransomware incidents consistently involved data exfiltration before encryption, frequent targeting of hypervisors and backup infrastructure, and deployment from compromised infrastructure servers or domain controllers.

Victimology in the provided reporting spans multiple sectors, with explicit mentions of finance, architecture, manufacturing, logistics, retail, real estate, financial services, environmental services, healthcare, and industrial environments. Unit 42 reporting cited attacks on multiple US facilities between July and November 2024, including energy, oil, and gas-related victims. Additional cited victims or claimed victims include Electrica Group in Romania, Dodd Group in the UK defense-contractor ecosystem, TriMed, Empire Group, True World Group, Rose Acre Farms, and a Chattanooga CBS affiliate television station. Reporting also states Lynx has targeted organizations in the US and UK and has been active in Oceania and healthcare-related incidents.

Several sources characterize Lynx as Russian-speaking or Russia-linked, though the content does not provide definitive attribution. It is repeatedly described as a successor to INC or closely tied to INC rather than as a fully distinct lineage. High-confidence indicators mentioned in the content include the .lynx encrypted-file extension, readme.txt ransom note, the clearnet URL hxxp://lynxblog[.]net/, and the .onion URLs hxxp://lynxch2k5xi35j7hlbmwl7d6u2oz4vp2wqp6qkwol624cod3d6iqiyqd[.]onion/login and hxxp://lynxbllrfr5262yvbgtqoyq76s7mpztcqkv6tjjxgpilpma7nyoeohyd[.]onion/disclosures, as well as a reported sample SHA-256 of 571f5de9dd0d509ed7e5242b9b7473c2b2cbb36ba64d38b32122a0a337d6cf8b.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details
INC

“Akira and Lynx: … Lynx might be a rebrand of the INC ransomware group.”

via risky biz rssnews.risky.biz
MITRE ATT&CK

Techniques & procedures

6 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique
T1053.005Scheduled TaskEvidence1

atexec, Remote scheduled task, Scheduled Task events (4698)... In one engagement, attackers leveraged Active Directory Group Policy to distribute the ransomware payload as a scheduled task across domain-joined systems, ensuring simultaneous execution at scale.

Persistence

1 technique
T1053.005Scheduled TaskEvidence1

atexec, Remote scheduled task, Scheduled Task events (4698)... In one engagement, attackers leveraged Active Directory Group Policy to distribute the ransomware payload as a scheduled task across domain-joined systems, ensuring simultaneous execution at scale.

T1053.005Scheduled TaskEvidence1

atexec, Remote scheduled task, Scheduled Task events (4698)... In one engagement, attackers leveraged Active Directory Group Policy to distribute the ransomware payload as a scheduled task across domain-joined systems, ensuring simultaneous execution at scale.

Lateral Movement

1 technique
T1570Lateral Tool TransferEvidence1

PsExec and direct access to administrative shares (ADMIN$, C$, etc.) remained present in some engagements... The most common approach involved executing the ransomware binary from a single compromised system — typically a domain controller or infrastructure server — and encrypting data on remote systems through administrative shares (ADMIN$, C$).

Exfiltration

2 techniques
T1041Exfiltration Over C2 ChannelEvidence1

“Lynx… employs double extortion tactics… can steal sensitive information and encrypt the victim’s data…” / “Attackers typically encrypt systems after exfiltrating sensitive data.” / “Qilin follows a double extortion model — encrypting victims’ files and threatening to leak stolen data…”

T1567Exfiltration Over Web ServiceEvidence1

ShinyHunters is a data extortion group specializing in large-scale data breaches and exposure of stolen datasets. In 2026, the group targeted healthcare-adjacent organizations, including medical technology companies, focusing on mass data exfiltration and leak-based extortion rather than encryption.

Impact

2 techniques
T1486Data Encrypted for ImpactEvidence6
TacticImpact

Ransomware operations have also become faster, with negotiations often beginning within hours of data exfiltration.

T1490Inhibit System RecoveryEvidence2
TacticImpact

Prior to encryption, attackers systematically targeted backup infrastructure and virtualization platforms to maximize impact and eliminate recovery options: Hypervisors (VMware ESXi, Hyper-V) – Destruction or encryption of virtual machines at the hypervisor level; Backup infrastructure (Veeam) – Access via compromised privileged accounts or exploitation of known Veeam vulnerabilities to delete or encrypt backup repositories.

INDICATORS OF COMPROMISE

IOCs tracked for this family

15 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app
Hashes
15 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting
hash.sha256●●●●●●●●●●●●View more in app1 month ago
hash.sha256●●●●●●●●●●●●View more in app1 month ago
hash.sha256●●●●●●●●●●●●View more in app1 month ago
hash.sha256●●●●●●●●●●●●View more in app1 month ago
hash.sha256●●●●●●●●●●●●View more in app1 month ago
hash.sha256●●●●●●●●●●●●View more in app1 month ago
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching15

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping6

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.