Lynx Ransomware
Lynx ransomware is a ransomware family first observed in 2024 and described as a new strain seen in active intrusions. Reporting in the provided content assesses it as part of the lineage that evolved from the INC Ransomware family, and later reporting states Sinobi is likely a rebrand or successor of Lynx. Technical comparison cited in the content found 63.2% function similarity between Lynx and Sinobi binaries, indicating substantial code overlap and likely shared tooling or source lineage.
The malware uses a hybrid cryptographic scheme, specifically AES-128 in CTR mode for file encryption and Curve25519 Donna/Curve25519 for asymmetric key exchange. In related reporting on the successor/rebrand activity, the ransomware is described as using per-file keys generated via CryptGenRandom, terminating processes associated with SQL Server, backup services, and Microsoft Exchange to unlock files for encryption, deleting Volume Shadow Copies, clearing the Recycle Bin, mounting hidden drives, and modifying the desktop wallpaper. The related family drops a README.txt ransom note with Tor-based negotiation instructions and a typical seven-day deadline.
Observed intrusion activity associated with Lynx includes deployment after initial access via valid compromised RDP credentials to an internet-exposed host. In the documented March 2025 intrusion, the actor laterally moved via RDP, created privileged look-alike accounts for persistence, performed network discovery with native tools and SoftPerfect Network Scanner, used NetExec for SMB enumeration/password spraying, collected data from network shares, compressed it with 7-Zip, exfiltrated it via temp.sh, deleted Veeam backup jobs, and then deployed Lynx ransomware across multiple backup and file servers via RDP. The payload in that case was named w.exe and was executed with arguments including "--dir E:\ --mode fast --verbose --noprint". Another mention states operators deleted backup jobs and deployed Lynx across multiple backup and file servers via RDP.
The content indicates Lynx is associated with double-extortion tradecraft through its assessed successor/rebrand, including data theft prior to encryption and pressure via Tor-based leak infrastructure. Targeting described in the provided material for the related operation includes medium-to-large organizations, especially where downtime is critical, with victims in manufacturing, healthcare, financial services, and education, and many victims in the United States. High-confidence observables directly mentioned for Lynx include the payload name w.exe in one intrusion and use of RDP for deployment; related lineage reporting also references generic payload names such as bin.exe and README.txt ransom notes.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
18 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Stealth
2 techniques
Stealth
Defense Impairment
1 technique
Defense Impairment
Discovery
3 techniques
Discovery
“When attackers gain access… they first gather system and infrastructure information…” / “After obtaining access, attackers performed additional information gathering…”
Lateral Movement
3 techniques
Lateral Movement
“The intrusion began with a single successful Remote Desktop Protocol (RDP) logon to an internet-exposed system… the threat actor moved laterally to a domain controller via RDP… deployed Lynx ransomware… across multiple backup and file servers via RDP.”
Collection
1 technique
Collection
Exfiltration
2 techniques
Exfiltration
Impact
4 techniques
Impact
“File Encryption: It encrypts files across the system, including network shares and drives (Encrypt network shares, Load hidden drives)… --encrypt-network.”
“The ransomware attempts to kill various system processes and services… targets services that might hinder the encryption process, such as backup-related services… EnumDependentServicesW and ControlService.”
IOCs tracked for this family
15 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Other indicator types observed in public reporting.
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
RaaS ransomware family assessed in the content as the immediate predecessor/rebrand lineage for Sinobi, with substantial code similarity indicating shared tooling/source.
Referenced as the ransomware family/group that Sinobi may have rebranded or splintered from; no additional technical details provided in the content.
Ransomware deployed manually via RDP. The payload ("w.exe") was dropped to servers and executed with arguments such as "--dir E:\ --mode fast --verbose --noprint" to encrypt targeted directories (noted as partial/fast encryption).
Ransomware using hybrid cryptography (AES-128 CTR + Curve25519 key exchange) and double-extortion; described as having an affiliate platform/tooling consistent with RaaS operations.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.