lynx Ransomware
Monitorado desde 29/07/2024
0
vítimas registradas
0
nos últimos 30 dias
0
CVEs
—
Última atividade
Lynx is a ransomware-as-a-service operation that emerged in mid-2024 as a rebrand of INC Ransomware (whose source code was sold for $300,000 on the RAMP forum), claiming ~300 victims across manufacturing, business services, technology, and transportation with an 80/20 profit split for affiliates.
Vulnerabilidades citadas para este grupo
CVEs associadas ao grupo pelo ransomware.live. Fichas ainda não publicadas aparecem sem link.
Nenhuma CVE associada a este grupo nas fontes.
Táticas e técnicas (MITRE ATT&CK)
Initial Access
T1078 Valid AccountsT1566.001 Phishing: Spearphishing Attachment Execution
T1059.001 Command and Scripting Interpreter: PowerShell Defense Evasion
T1036 MasqueradingT1562.001 Disable or Modify Tools Credential Access
T1003.001 OS Credential Dumping: LSASS Memory Discovery
T1012 Query RegistryT1082 System Information Discovery Lateral Movement
T1021.001 Remote Services: Remote Desktop Protocol Exfiltration
T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage Command and Control
T1071.001 Application Layer Protocol: Web Protocols Impact
T1486 Data Encrypted for ImpactT1490 Inhibit System Recovery Ferramentas observadas
Discovery Enum
SoftPerfect NetScan
Exfiltration
Restic
Vítimas divulgadas em sites de vazamento, segundo o ransomware.live. Não exibimos nomes de vítimas. · Ver no ransomware.live