lynx

T1078Valid Accounts

Compromised credentials purchased from initial access brokers used to authenticate via RDP and VPN.

T1566.001Phishing: Spearphishing Attachment

Lynx uses phishing emails with malicious attachments to deliver initial access stagers.

T1059.001Command and Scripting Interpreter: PowerShell

PowerShell used for payload execution and post-exploitation activity.

T1036Masquerading

Lynx ransomware binary renamed to blend into normal file system activity; masquerades as legitimate utilities.

T1562.001Disable or Modify Tools

Security tools disabled before ransomware deployment.

T1003.001OS Credential Dumping: LSASS Memory

Credential dumping from LSASS used to facilitate lateral movement.

T1012Query Registry

Registry queried to identify installed security software and system configuration before encryption.

T1082System Information Discovery

Lynx queries CPU information and system details to assess the target environment and check for sandbox/analysis conditions.

T1021.001Remote Services: Remote Desktop Protocol

RDP used for lateral movement with harvested credentials.

T1567.002Exfiltration Over Web Service: Exfiltration to Cloud Storage

Data exfiltrated for double extortion via the Lynx leak site prior to encryption.

T1071.001Application Layer Protocol: Web Protocols

C2 communication over HTTPS; Tor used for victim negotiation portals.

T1486Data Encrypted for Impact

Lynx uses AES-128 CTR mode for file encryption with RSA-2048 for key protection. Code similarities indicate it may be a rebrand or fork of INC Ransomware. Emerged mid-2024; highly aggressive targeting of SMBs and mid-market organizations across multiple sectors. Appends .lynx extension.

T1490Inhibit System Recovery

Shadow copies deleted and recovery options disabled to prevent victim restoration.