Lynx

Lynx is a financially motivated ransomware-as-a-service operation that emerged in mid-2024 and is widely assessed as an evolution or rebrand of INC Ransom, with substantial code overlap reported between the two malware families and shared affiliate ecosystem links. Known aliases include lynxblog and lynx_ransomware. The operation uses double extortion, combining file encryption with data exfiltration and publication pressure through leak-site and negotiation infrastructure. Victim communications are conducted through authenticated portals and dedicated contact channels, and the group has maintained an active leak-blog presence since 2024. Lynx has targeted organizations globally, with reporting tying activity to victims in the United States, the United Kingdom, Germany, Australia, and elsewhere. Sectors directly associated with Lynx victimization include health care, financial services, manufacturing, energy, construction and architecture, information technology manufacturing, real estate and business services, and government or emergency-services entities. Reporting also links a shared affiliate between Lynx and the FortiBleed access ecosystem, indicating downstream use of compromised perimeter infrastructure for ransomware deployment. The malware and operations associated with Lynx support core ransomware lifecycle behaviors including initial access through affiliates, persistence, exfiltration, defense evasion, and impact via encryption. Technical reporting describes AES-based multithreaded encryption, hidden-drive discovery and mounting, deletion of shadow-copy data through low-level device control rather than common administrative utilities, desktop-wallpaper modification, ransom-note printing to local printers, and host and network discovery behaviors aligned with ATT&CK techniques such as system, process, file, and network-share enumeration. Public reporting also characterizes Lynx as part of a broader affiliate ecosystem with overlaps to historical RaaS operations including Nemty, Nemty X, Karma, and Nokoyawa. Separate reporting observed an affiliate previously linked to the Lynx and INC ecosystems deploying DeadLock ransomware, reinforcing the role of Lynx as an affiliate-driven criminal ecosystem rather than a single closed operator set.