lynx Ransomware
Tracked since Jul 29, 2024
0
victims recorded
0
in the last 30 days
0
CVEs
—
Last activity
Lynx is a ransomware-as-a-service operation that emerged in mid-2024 as a rebrand of INC Ransomware (whose source code was sold for $300,000 on the RAMP forum), claiming ~300 victims across manufacturing, business services, technology, and transportation with an 80/20 profit split for affiliates.
Vulnerabilities cited for this group
CVEs associated with the group by ransomware.live. Records not yet published here appear without a link.
No CVE associated with this group in the sources.
Tactics and techniques (MITRE ATT&CK)
Initial Access
T1078 Valid AccountsT1566.001 Phishing: Spearphishing Attachment Execution
T1059.001 Command and Scripting Interpreter: PowerShell Defense Evasion
T1036 MasqueradingT1562.001 Disable or Modify Tools Credential Access
T1003.001 OS Credential Dumping: LSASS Memory Discovery
T1012 Query RegistryT1082 System Information Discovery Lateral Movement
T1021.001 Remote Services: Remote Desktop Protocol Exfiltration
T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage Command and Control
T1071.001 Application Layer Protocol: Web Protocols Impact
T1486 Data Encrypted for ImpactT1490 Inhibit System Recovery Observed tools
Discovery Enum
SoftPerfect NetScan
Exfiltration
Restic
Victims posted on leak sites, according to ransomware.live. Victim names are not displayed. · View on ransomware.live