— Lynx¶
Threat-actor battle card · maintained from public sources · last updated 2026-10-02
Overview¶
Lynx is a Ransomware-as-a-Service operation that emerged in July 2024 and is now confirmed as a direct rebrand of the INC Ransomware operation, whose source code was reportedly sold on the RAMP cybercrime forum for $300,000 in May 2024. The confirmation came in July 2026: FortiBleed forensics (Unit 42/Fortinet PSIRT) observed a single operator simultaneously logged into both an INC Ransom negotiation panel and a Lynx negotiation panel during active negotiations — direct operational evidence, not just code analysis. Unit 42 analysis had already confirmed roughly half of Lynx's codebase maps directly to INC, with even greater overlap in the Linux/ESXi variant. The United States accounts for 208 victims (~53%) of the pre-resumption count, Canada 20, with the balance spread across Europe and APAC. Top sectors: Business Services (80 victims), Manufacturing (79), Technology (41), Transportation (29). Lynx is a named co-threat alongside Akira in targeting MSPs — shared preference for RDP/credential-based access makes MSP fleets a high-leverage entry point for both groups. Lynx publicly claims to avoid healthcare, government, and non-profits — a self-imposed restriction it has violated in practice. DLS activity resumed after a lull: Lynx had reached 416 claimed victims by Aug 6, 2026 and 417 by Sep 14, 2026, now spanning 48 countries (up from 20+ through June). Current sector concentration: Manufacturing (~22%), Professional Services (~21%), Technology (~12%). Blackpoint Cyber — Lynx Threat Profile · ransomware.live — Lynx Independent aggregator cyberthreatintelligence.net ranks Lynx 11th among all tracked ransomware groups by cumulative claimed victims (411, between TheGentlemen at #10 and Medusa at #12) as of early Sept 2026 — Lynx is not yet on BlueSec's own Tier-1 leaderboard. cyberthreatintelligence.net
Tradecraft¶
- RaaS model with an 80% affiliate revenue share — a competitive payout designed to attract displaced talent from disrupted groups (LockBit, ALPHV, RansomHub).
- Initial access: phishing emails with malicious attachments, RDP brute-force against exposed endpoints, credential stuffing using infostealer logs, and purchased credentials from dark-web markets.
- Exploited CVEs (2024): CVE-2024-54085 and CVE-2024-0769 in internet-facing systems.
- Encryption: Curve25519/ChaCha20 hybrid; appends
.LYNXextension to encrypted files; drops a Base64-encoded ransom note. A technical deep-dive refines this: AES-128 in CTR mode with Curve25519 "Donna" key exchange, using partial encryption (encrypts ~1MB of every 6MB block) to speed mass-encryption runs. Cybaverse — Technical Deep Dive: Lynx Ransomware Variant Analysis - Privilege escalation: enables
SeTakeOwnershipPrivilegeto seize ownership of file objects and rewrite DACLs ahead of encryption. Discovery: enumerates running processes viaCreateToolhelp32Snapshot/TH32CS_SNAPPROCESSto kill protective or competing processes. Persistence: scheduled tasks, Run-key registry modifications, malicious service creation. Some intrusions use IT-helpdesk impersonation/social-engineering pretexting for initial access alongside legitimate remote-access tools. SOCRadar — Dark Web Profile: Lynx Ransomware - Linux/ESXi variant — code largely inherited from INC Ransomware, enabling mass-encryption of virtualised infrastructure.
- Double extortion: data exfiltrated before encryption, staged on DLS with escalating deadlines.
- CIS exclusion clause appears to be in place; affiliates appear to respect it more consistently than the "ethical" sector restrictions.
- FortiBleed campaign (July 2026): confirmed INC Ransom and Lynx negotiation panels operated simultaneously by the same actor during active victim negotiations — establishing beyond code analysis that the groups share an operator. Campaign deployed ransomware on 12+ of the 86,644 compromised FortiGate devices (430,000+ FortiGate firewalls had credentials harvested campaign-wide; ransomware deployment was observed on that subset of 86,644 — Security Affairs); a credential server holding ~73,000 harvested credential sets was left publicly exposed; ~110M credential pairs exfiltrated via FortiGate Sniffer across the full campaign (CVE-2026-24858, CVSS 9.8). Downstream intrusion risk from credential reuse is a multi-quarter exposure across the affected credential inventory (confirmed to include Chevron, Samsung, AT&T, Comcast).
- SonicWall SMA 1000 campaign (August 2026): INC (same operator) is the dominant actor exploiting CVE-2026-15409 (CVSS 10.0, pre-auth WebSocket tunnel) chained with CVE-2026-15410 (CVSS 7.2, path traversal to root). Zero-day exploitation began June 22; patched and added to CISA KEV July 14. INC's distinctive tactic in this campaign: extracting TOTP MFA seed configurations from SMA appliances alongside session databases and credentials, enabling persistent authenticated access that survives password resets. Post-exploitation includes direct victim phone calls as a pressure tactic. 893+ total INC victims as of August 10, 38 new in the prior 30 days. New victims span Australia, US, UAE, Colombia, Switzerland. [Resecurity, The Hacker News, SC Media — August 2026]
Notable victims¶
- Electrica Group (Romania; major electricity supplier serving 3.8M citizens; Dec 2024) — CIS Security
- DZS Inc. (US; global network-solutions vendor; $18.1M ransom demanded; ~30GB exfiltrated; 2024) — Halcyon
- Hunter Taubman Fischer & Li LLC (US law firm specialising in corporate and securities law; Jan 2025) — SOCRadar
- CONAD (Italy; major retail chain; Jan 2025) — Picus Security
- Zamzows, Inc. (US; Idaho-based lawn, garden and pet-supply retail chain; Feb 2025) — Cyble
- Lakelands Public Health (Canada; Ontario regional public-health unit serving Peterborough, Northumberland, Haliburton, Kawartha Lakes; intrusion detected Jan 29, 2026; ~60,000 residents notified that health records dating back to 1996 — names, OHIP numbers, diagnoses, medication/treatment and vaccination history — may have been exposed) — a direct violation of Lynx's stated no-government/no-healthcare policy — UpGuard · Peterborough Today
Assessment¶
A mature, fast-scaling RaaS operation with its INC Ransomware lineage now operationally confirmed rather than inferred from code analysis. The July 2026 FortiBleed forensics — a shared operator simultaneously active in both INC Ransom and Lynx negotiation panels — is the most significant ransomware rebrand confirmation of 2026; defenders who attributed incidents only to one brand have been tracking half the actor's footprint. The 80% affiliate cut makes Lynx a magnet for talent displaced from disrupted groups. The ESXi variant enables rapid virtualisation-layer encryption, extending blast radius well beyond Windows endpoints. Energy and utilities targeting — confirmed by an attack on Romania's largest electricity supplier — makes this relevant for critical-infrastructure portfolios. The Acronis/Halcyon finding that MSPs are a top shared target with Akira is significant: a compromised MSP multiplies exposure across all of its managed tenants. CIS exclusion and stated sector restrictions match Eastern European criminal norms but provide no protection for Western enterprise. Lynx's DLS resumed posting after a June lull and has continued through at least Aug 29, 2026 — the "quiet since June" read in the prior update no longer holds. No law-enforcement action specifically against Lynx or its INC operator has been reported as of Oct 2026; by contrast, the Sept 2026 takedown of KillSec (a much smaller gang) shows disruption attention is currently going to lower-tier crews, not this one. The Hacker News — KillSec takedown The INC operator is demonstrably not idle — the FortiBleed credential harvest and the August SonicWall MFA-seed campaign show the same actor escalating toward infrastructure-level, persistence-first access operations. The MFA seed theft is particularly significant: it means remediation of a SonicWall intrusion requires replacing hardware or wiping and re-provisioning TOTP seeds, not just rotating passwords. Priority defences: RDP hardening and MFA; infostealer credential monitoring (dark-web feeds); ESXi network segmentation; offline backup integrity verification; heightened MSP-specific controls (PAM, client network isolation); any organisation with FortiGate devices should treat the FortiBleed credential exposure period (pre-CVE-2026-24858 patch) as a presumed-access window requiring full credential rotation.
Sources¶
- Unit 42 — Lynx: INC Ransomware Rebrand
- Halcyon — Lynx threat group profile
- FortiGuard Labs — Ransomware Roundup: Lynx
- CIS Security — Lynx Ransomware Pouncing on Utilities
- Picus Security — Lynx: How INC Ransomware Rebrands Itself
- SOCRadar — Dark Web Profile: Lynx Ransomware
- Cyble — Lynx Ransomware Threat Actor Profile
- Darktrace — New Threat on the Prowl: Investigating Lynx Ransomware
- Acronis — MSPs a top target for Akira and Lynx ransomware
- Intel 471 — Lynx Ransomware
- ransomware.live — Lynx group page
- BleepingComputer — FortiBleed: INC Ransom and Lynx operated by same actor
- SOCRadar — FortiBleed investigation: 73K credential server, INC=Lynx confirmation
- Resecurity — From WSProxy to Root: INC ransomware and SonicWall SMA Exploit Chain
- The Hacker News — INC Ransomware Emerges as Dominant Actor Exploiting SonicWall SMA 1000 Flaws
- SC Media — INC Ransomware chains two SonicWall SMA 1000 zero-days
- Blackpoint Cyber — Lynx Ransomware Threat Profile
- cyberthreatintelligence.net — Ransomware Victims Database
- UpGuard — Lakelands Public Health Data Breach
- Peterborough Today — Cyberattack at Lakelands Public Health may affect 60,000 residents
- Cybaverse — Technical Deep Dive: Lynx Ransomware Variant Analysis
- Security Affairs — 430,000 FortiGate Devices Exposed in FortiBleed Ransomware Link
- The Hacker News — Police Arrest 16-Year-Old Suspected of Running KillSec
🗂️ Attacks & victims¶
All disclosed victims attributed to this actor, newest first.
February 2026