Overview
Lynx is a ransomware-as-a-service operation that emerged in mid-2024 as a rebrand of INC Ransomware (whose source code was sold for $300,000 on the RAMP forum), claiming ~300 victims across manufacturing, business services, technology, and transportation with an 80/20 profit split for affiliates.
What public reporting says
- Lynx emerged in 2024 and shares roughly 70% of its functions and 50% of its code with INC Ransom, which makes it a rebrand or fork of that operation.
Geography: origin and targets
No public attribution of origin. Lines are drawn only where public reporting places the operators; flags show where the group has claimed victims, sized by number of claims.
United States of America219
United Kingdom29
Canada22
Germany17
Australia16
France9
Italy9
Singapore8
Spain7
Japan7
Exploited vulnerabilities
None recorded in the sources we reviewed.
ATT&CK techniques
Columns are ATT&CK tactics; each cell is a technique reported for this group in public sources. A technique appearing here means it has been reported for the group, not that it was used in any particular incident, and an empty cell is not evidence that the group does not use it.
| Initial Access | Execution | Defense Evasion | Credential Access | Discovery | Lateral Movement | Exfiltration | Command and Control | Impact |
|---|---|---|---|---|---|---|---|---|
| Valid Accounts | Command and Scripting Interpreter: PowerShell | Masquerading | OS Credential Dumping: LSASS Memory | Query Registry | Remote Services: Remote Desktop Protocol | Exfiltration Over Web Service: Exfiltration to Cloud Storage | Application Layer Protocol: Web Protocols | Data Encrypted for Impact |
| Phishing: Spearphishing Attachment | Disable or Modify Tools | System Information Discovery | Inhibit System Recovery |
Technique details
Initial Access (TA0001)
- T1078 · Valid Accounts: Compromised credentials purchased from initial access brokers used to authenticate via RDP and VPN.
- T1566.001 · Phishing: Spearphishing Attachment: Lynx uses phishing emails with malicious attachments to deliver initial access stagers.
Execution (TA0002)
- T1059.001 · Command and Scripting Interpreter: PowerShell: PowerShell used for payload execution and post-exploitation activity.
Defense Evasion (TA0005)
- T1036 · Masquerading: Lynx ransomware binary renamed to blend into normal file system activity; masquerades as legitimate utilities.
- T1562.001 · Disable or Modify Tools: Security tools disabled before ransomware deployment.
Credential Access (TA0006)
- T1003.001 · OS Credential Dumping: LSASS Memory: Credential dumping from LSASS used to facilitate lateral movement.
Discovery (TA0007)
- T1012 · Query Registry: Registry queried to identify installed security software and system configuration before encryption.
- T1082 · System Information Discovery: Lynx queries CPU information and system details to assess the target environment and check for sandbox/analysis conditions.
Lateral Movement (TA0008)
- T1021.001 · Remote Services: Remote Desktop Protocol: RDP used for lateral movement with harvested credentials.
Exfiltration (TA0010)
- T1567.002 · Exfiltration Over Web Service: Exfiltration to Cloud Storage: Data exfiltrated for double extortion via the Lynx leak site prior to encryption.
Command and Control (TA0011)
- T1071.001 · Application Layer Protocol: Web Protocols: C2 communication over HTTPS; Tor used for victim negotiation portals.
Impact (TA0040)
- T1486 · Data Encrypted for Impact: Lynx uses AES-128 CTR mode for file encryption with RSA-2048 for key protection. Code similarities indicate it may be a rebrand or fork of INC Ransomware. Emerged mid-2024; highly aggressive targeting of SMBs and mid-market organizations across multiple sectors. Appends .lynx extension.
- T1490 · Inhibit System Recovery: Shadow copies deleted and recovery options disabled to prevent victim restoration.
Tools
- SoftPerfect NetScan
- Restic
Leak-site infrastructure
| Title | Type | Address (defanged) | Seen online at snapshot |
|---|---|---|---|
| Lynx | Chat | lynxchatly4zludmhmi75jrwhycnoqvkxb4prohxmyzf4euf5gjxroad[.]onion | Yes |
| Lynx | DLS | lynxblog[.]net | No |
| Lynx | DLS | lynxch2k5xi35j7hlbmwl7d6u2oz4vp2wqp6qkwol624cod3d6iqiyqd[.]onion | No |
| Lynx | DLS | lynxblogmx3rbiwg3rpj4nds25hjsnrwkpxt5gaznetfikz4gz2csyad[.]onion | Yes |
| Lynx | DLS | lynxblogijy4jfoblgix2klxmkbgee4leoeuge7qt4fpfkj4zbi2sjyd[.]onion | Yes |
| Lynx | DLS | lynxblogtwatfsrwj3oatpejwxk5bngqcd5f7s26iskagfu7ouaomjad[.]onion | Yes |
| Lynx | DLS | lynxblogxstgzsarfyk2pvhdv45igghb4zmthnzmsipzeoduruz3xwqd[.]onion | Yes |
| Lynx | DLS | lynxblogxutufossaeawlij3j3uikaloll5ko6grzhkwdclrjngrfoid[.]onion | No |
| Lynx | DLS | lynxblogco7r37jt7p5wrmfxzqze7ghxw6rihzkqc455qluacwotciyd[.]onion | Yes |
| Lynx | DLS | lynxblogoxllth4b46cfwlop5pfj4s7dyv37yuy7qn2ftan6gd72hsad[.]onion | Yes |
Sources and caveats
Group descriptions, ATT&CK mappings, tools and leak-site locations come from public ransomware tracking projects, including ransomware.live and Crocodyli. Exploited vulnerabilities come from the Ransomware-Vulnerability-Matrix by BushidoUK (licensed CC BY 4.0), supplemented where a group profile there is newer than the data we hold. Each CVE links to its original research source. Technical text is shown in English as published. Leak-site addresses are defanged and shown for blocking and detection; do not visit them. Nothing here is verified by ClairSec_ against a specific incident.
Data snapshot: 2026-10-11