Lynx Ransomware and Its Evolution from the INC Lineage

Executive Summary

Lynx is a financially motivated Ransomware-as-a-Service (RaaS) operation that emerged in July 2024 and has established itself as a mature double-extortion threat through a structured affiliate model and well-developed operational infrastructure. Analysis of publicly disclosed victim data identified 414 victims across 48 countries, with the United States representing the most affected region, while Business Services and Manufacturing accounted for nearly 40% of observed victims. The group's operations employ diverse initial access techniques—including phishing, compromised credentials, RDP compromise, VPN exploitation, and credential abuse—followed by enterprise-wide reconnaissance, lateral movement, data exfiltration, and ransomware deployment supported by dedicated Tor-based negotiation and leak infrastructure. Observed infrastructure overlaps also indicate a potential operational relationship between the FortiBleed credential harvesting campaign and the broader Lynx/INC ransomware ecosystem, highlighting the possible integration of large-scale credential harvesting with enterprise ransomware operations. The group's operational maturity, technical flexibility, and global targeting demonstrate its continued capability to conduct sophisticated ransomware campaigns against organizations across multiple sectors and geographic regions.

Threat Profile

Group Overview

Lynx is a financially motivated Ransomware-as-a-Service (RaaS) operation that emerged in July 2024, rapidly establishing itself as an active threat within the ransomware ecosystem. The group conducts attacks using a double-extortion model, combining data theft with file encryption to maximize pressure during ransom negotiations. Organizations that refuse to pay face both operational disruption and the public disclosure of stolen information through the group's dedicated leak platform. 

Lynx is widely assessed to represent a rebranding or operational evolution of the INC ransomware operation. The group's emergence closely followed the decline of INC, while substantial similarities in encryption routines, execution logic, command-line functionality, malware architecture, and operational infrastructure indicate a strong technical relationship between the two ransomware families. The reported circulation of the INC ransomware source code on underground forums prior to Lynx's emergence further supports the possibility that components of the original codebase were adapted or repurposed. Although the precise transition cannot be independently verified, the observed technical overlap indicates that Lynx evolved into a more mature RaaS ecosystem with expanded affiliate capabilities, centralized infrastructure, and enhanced extortion operations.

Lynx publicly portrays itself as an "ethical" ransomware operation, claiming to avoid targeting government institutions, healthcare providers, churches, and non-profit organizations. However, publicly disclosed victims include organizations associated with several of these sectors, demonstrating that observed targeting activity does not consistently align with the group's stated operating principles. Like many financially motivated ransomware groups, victim selection appears to be driven primarily by access opportunities, the value of compromised data, and the potential for successful extortion rather than adherence to publicly declared targeting restrictions.

Operational Characteristics

Lynx operates through a closed Ransomware-as-a-Service (RaaS) affiliate model, in which the core operators maintain centralized control over ransomware development, leak infrastructure, negotiation platforms, and supporting operational services, while affiliates are responsible for obtaining initial access, conducting intrusions, deploying the ransomware payload, and negotiating with victims. The affiliate program reportedly provides participants with approximately 80% of ransom proceeds, together with access to ransomware builders, cross-platform payloads, victim management portals, and supporting infrastructure designed to facilitate coordinated ransomware operations.

Affiliate recruitment is conducted through Russian-language underground forums, including the RAMP cybercrime forum, using a selective vetting process targeting experienced intrusion operators. Recruitment guidance indicates that operators located within CIS countries and China are excluded from participation. The operation emphasizes double-extortion, combining data theft with file encryption while leveraging structured negotiation workflows, automated operational capabilities, and a mature affiliate ecosystem to support enterprise-scale ransomware campaigns.

Victimology

Overview

Analysis of publicly disclosed leak-site data identified 414 victims across 48 countries, indicating sustained operational activity since Lynx emerged in July 2024. While leak-site disclosures provide valuable insight into the group's targeting patterns, they represent only publicly announced incidents and are unlikely to reflect the full scale of operations, as organizations that negotiate, recover privately, or otherwise resolve incidents may never appear on public disclosure platforms.

The disclosed victims range from small and medium-sized enterprises (SMEs) to large multinational organizations operating across commercial, industrial, and critical infrastructure sectors. This diversity suggests that Lynx prioritizes organizations offering high extortion potential rather than targeting specific organization sizes. Furthermore, the consistent publication of new victims, structured leak announcements, and staged disclosure of stolen information reflects a mature and well-organized Ransomware-as-a-Service (RaaS) operation supported by multiple active affiliates rather than opportunistic ransomware campaigns.

Geographical Distribution

Analysis of observed victims indicates that North America remains the primary region targeted by Lynx operations, with the United States accounting for 221 publicly disclosed victims, significantly exceeding all other affected countries. As illustrated in below image, the United Kingdom (28) and Canada (22) represent the next most targeted countries, followed by Germany (17), Australia (16), France (10), Italy (9), Singapore (8), and Spain and Japan with 7 victims each. This distribution demonstrates a clear concentration of attacks against organizations operating in North America and Western Europe, while also reflecting continued activity across the Asia-Pacific region.

Lynx has also targeted organizations across a broader international landscape. Additional publicly disclosed victims were identified in Sweden (6), India (5), Taiwan (4), Austria (4), Brazil (4), and Thailand (4). Smaller numbers of victims were observed in Romania (3) and the United Arab Emirates (3), while Chile, Switzerland, Paraguay, Saudi Arabia, Dominica, and Costa Rica each recorded two victims. The remaining affected countries—including Poland, Ethiopia, Colombia, Finland, Peru, Hong Kong, Argentina, Kenya, Israel, Mexico, Puerto Rico, Morocco, the Czech Republic, Jamaica, Norway, South Africa, Portugal, Malta, China, Malaysia, the Netherlands, South Korea, Belgium, and Venezuela—each accounted for a single publicly disclosed victim, highlighting the group's extensive global reach.

The concentration of victims within North America and Western Europe suggests a preference for organizations operating in mature economies with extensive digital infrastructure and a greater likelihood of successful extortion. Nevertheless, the group's presence across 48 countries demonstrates that its operations are not geographically constrained and are capable of targeting organizations worldwide. The observed victim distribution aligns more closely with opportunistic targeting based on enterprise exposure and financial value than with any specific geopolitical objective.

Sector Targeting

Analysis of publicly disclosed victims indicates that Business Services (20.05%) and Manufacturing (19.32%) represent the two most frequently targeted sectors, together accounting for nearly 40% of all observed victims. As illustrated in above image, Technology (9.90%) ranks as the third most affected sector, followed by Transportation & Logistics (7.00%) and Construction (7.00%). Additional targeting was observed across Consumer Services (5.80%), Financial Services (5.31%), and Agriculture & Food Production (5.31%), indicating a sustained focus on industries where operational disruption, supply chain dependencies, and commercially sensitive information can significantly increase extortion pressure.

Beyond these highly targeted industries, Lynx has also compromised organizations operating in Healthcare (4.83%), Hospitality & Tourism (4.11%), Energy (3.62%), Public Sector (3.38%), Education (2.66%), and Telecommunications (1.69%). The broad distribution of victims across both public and private sectors demonstrates that the group does not limit its operations to a specific industry, instead pursuing organizations that present accessible attack surfaces, valuable corporate data, and a higher likelihood of successful ransom negotiations.

The observed sector distribution reflects a financially motivated targeting strategy focused on organizations whose operational dependence and sensitive business information provide substantial leverage during double-extortion campaigns. Notably, the presence of victims within Healthcare, Energy, and the Public Sector contrasts with Lynx's public claims that it avoids targeting socially important institutions, suggesting that affiliate-driven targeting decisions or operational realities may not consistently align with the restrictions outlined in the group's public statements.

Technical Analysis

Initial Access and Foothold

Observed intrusion activity indicates that Lynx affiliates employ multiple techniques to obtain initial access, including spear-phishing campaigns, compromised credentials, credential stuffing, Remote Desktop Protocol (RDP) compromise, exploitation of internet-facing applications, and vulnerable VPN services. Compromised credentials are also obtained through infostealer logs, underground credential marketplaces, and Initial Access Brokers (IABs), providing affiliates with authenticated access to enterprise environments. The diversity of these access vectors demonstrates a flexible intrusion strategy that enables affiliates to adapt their operations according to the target's exposed infrastructure and security posture rather than relying on a single compromise method.

Following successful access, affiliates typically perform internal reconnaissance to identify privileged accounts, domain controllers, backup infrastructure, virtualization platforms, and file servers before deploying ransomware. The use of legitimate credentials and native administrative tools allows operators to blend malicious activity with normal system administration, reducing the likelihood of early detection while facilitating coordinated ransomware deployment across enterprise environments.

Privilege Escalation, Defense Evasion, and Persistence

Assessment of observed tradecraft suggests that Lynx primarily relies on administrative privileges obtained during the initial compromise rather than exploiting dedicated privilege escalation vulnerabilities. The group's operational workflow also demonstrates the use of SeTakeOwnershipPrivilege token manipulation and, in certain campaigns, Bring Your Own Vulnerable Driver (BYOVD) techniques to weaken endpoint security controls prior to ransomware deployment.

To evade detection and complicate recovery efforts, the ransomware terminates services associated with antivirus products, backup software, Microsoft SQL Server, Microsoft Exchange, Java applications, and Veeam before deleting Volume Shadow Copies and other recovery artifacts. Analysis of observed campaigns has not identified a standardized persistence mechanism, suggesting that affiliates generally maintain access through compromised credentials, existing remote administration channels, and previously established enterprise access until ransomware deployment is complete.

Data Exfiltration

Data theft is a core component of Lynx operations and typically precedes file encryption. Affiliates exfiltrate financial records, intellectual property, contractual documents, internal communications, customer information, and other sensitive business data before directing victims to dedicated Tor-based negotiation portals for ransom discussions.

Organizations that refuse to negotiate risk the public disclosure of stolen information through the group's dedicated leak site. The extortion process commonly follows a staged disclosure model, in which limited samples of stolen data are published initially, followed by progressively larger releases to maintain pressure throughout negotiations and increase the likelihood of ransom payment.

Encryption 

Lynx supports multiple encryption modes—including fast, medium, slow, and entire—allowing affiliates to customize ransomware deployment according to operational objectives. Technical analysis identifies the use of AES-128 (CTR mode) for file encryption together with Curve25519 Donna for key exchange. The ransomware supports selective encryption of files, directories, network shares, hidden drives, and virtualized environments, while encrypted files are appended with the .lynx extension.

During execution, the ransomware terminates critical services associated with antivirus products, backup software, SQL Server, Microsoft Exchange, Java applications, and Veeam before deleting Volume Shadow Copies and other recovery artifacts. It also utilizes the Windows Restart Manager API to encrypt files that are actively in use, reducing file-locking issues during execution. Linux and ESXi variants can terminate running virtual machines and remove snapshots prior to encryption, increasing the operational impact on virtualized environments. Upon completion, ransom notes are written throughout the compromised environment, desktop wallpapers may be modified, and connected printers can automatically receive printed ransom demands to maximize victim awareness and extortion pressure.

FortiBleed and Lynx Operational Link

FortiBleed Scanner

Is your Fortinet firewall in the breach?

Attackers are quietly stealing working admin passwords to Fortinet firewalls and VPNs — and selling access before anyone notices. Enter your domain to see if yours is already exposed.

CLICK THE LINK BELOW

   FortiBleed Scanner | CyberXTron

The FortiBleed credential harvesting operation demonstrates a large-scale infrastructure designed to automate the validation of usernames and passwords collected from internet-facing Fortinet FortiGate appliances. The observed infrastructure contains enterprise credentials spanning multiple organizations and geographic regions, indicating a systematic credential validation process rather than opportunistic credential collection.

Further observations identify operational overlaps between the FortiBleed infrastructure and the broader Lynx/INC ransomware ecosystem. Investigations identified an operator simultaneously authenticated to both the INC Ransom and Lynx negotiation panels using infrastructure associated with the credential harvesting operation. Independent comparison of victim datasets also identified overlapping organizations between FortiBleed infrastructure and an exposed INC-linked directory, indicating that some organizations targeted during credential harvesting were also associated with ransomware activity.

If these observations reflect a shared operational environment, the FortiBleed campaign may illustrate an evolution in ransomware operations by integrating large-scale credential harvesting into the initial access phase. Rather than relying solely on phishing campaigns or exploitation of internet-facing vulnerabilities, validated VPN credentials could provide affiliates with authenticated enterprise access, enabling more efficient lateral movement and ransomware deployment. While the observed infrastructure overlaps and victim correlations suggest a potential operational relationship with the Lynx/INC ecosystem, the precise nature and extent of this association remain unconfirmed.

(This is an ongoing and developing story that CyberXtron™ will update as new information emerges from our monitoring and analysis.)

Command and Control (C2)

Lynx primarily utilizes Tor-hosted infrastructure to facilitate victim communication, ransom negotiations, and data leak operations instead of relying on traditional malware command-and-control (C2) channels. The infrastructure incorporates multiple hidden services and negotiation mirrors, providing redundancy and maintaining communication continuity should individual services become unavailable. Operational updates and additional negotiation mirror addresses are also distributed through the platform to ensure continued access to communication services.

Following ransomware deployment, victims are directed to dedicated Tor-based negotiation portals using unique victim identifiers, where affiliates manage ransom discussions, payment instructions, and data disclosure timelines. This centralized communication model streamlines the extortion process while reducing dependence on conventional C2 infrastructure and enhancing the operational resilience of the group's communication ecosystem.

To improve communication reliability, the ransom note includes both primary and mirror Tor addresses, together with an alternative Proton Mail contact. This multi-channel communication approach provides redundancy within the group's negotiation infrastructure, allowing victims to maintain contact even if individual communication channels become unavailable. 

MITRE ATT&CK

Indicators of Compromise (IOCs)