HackerFeeds
All ransomware groups

lynx

417 tracked victims
·first seen 2023-05-22·last activity 2026-08-27

Activity analysis

HackerFeeds has tracked 417 victims claimed by lynx since May 2023, most recently in August 2026 — ranking #18 of 332 groups (1.2% of all tracked ransomware victims). It posted 1 victims in the last 90 days, down 83% on the previous 90 days (6). Its most-targeted sector is Business Services (81 victims), followed by Manufacturing (79). The United States accounts for 218 victims (53% of those with a known location); 5 victims did not disclose a location.

Victims per year

  • 20231
  • 2024116
  • 2025240
  • 202660

Top sectors

  • Business Services81
  • Manufacturing79
  • Technology41
  • Transportation/Logistics29
  • Construction27
  • Financial Services23

Computed from victims claimed on the group's leak site as collected by HackerFeeds; claims are not independently verified. Monthly reports · Methodology

Group profile

Lynx is a ransomware-as-a-service operation that emerged in mid-2024 as a rebrand of INC Ransomware (whose source code was sold for $300,000 on the RAMP forum), claiming ~300 victims across manufacturing, business services, technology, and transportation with an 80/20 profit split for affiliates.

MITRE ATT&CK TTPs

TA0001

Initial Access

  • T1078Valid Accounts

    Compromised credentials purchased from initial access brokers used to authenticate via RDP and VPN.

  • T1566.001Phishing: Spearphishing Attachment

    Lynx uses phishing emails with malicious attachments to deliver initial access stagers.

TA0002

Execution

  • T1059.001Command and Scripting Interpreter: PowerShell

    PowerShell used for payload execution and post-exploitation activity.

TA0005

Defense Evasion

  • T1036Masquerading

    Lynx ransomware binary renamed to blend into normal file system activity; masquerades as legitimate utilities.

  • T1562.001Disable or Modify Tools

    Security tools disabled before ransomware deployment.

TA0006

Credential Access

  • T1003.001OS Credential Dumping: LSASS Memory

    Credential dumping from LSASS used to facilitate lateral movement.

TA0007

Discovery

  • T1012Query Registry

    Registry queried to identify installed security software and system configuration before encryption.

  • T1082System Information Discovery

    Lynx queries CPU information and system details to assess the target environment and check for sandbox/analysis conditions.

TA0008

Lateral Movement

  • T1021.001Remote Services: Remote Desktop Protocol

    RDP used for lateral movement with harvested credentials.

TA0010

Exfiltration

  • T1567.002Exfiltration Over Web Service: Exfiltration to Cloud Storage

    Data exfiltrated for double extortion via the Lynx leak site prior to encryption.

TA0011

Command and Control

  • T1071.001Application Layer Protocol: Web Protocols

    C2 communication over HTTPS; Tor used for victim negotiation portals.

TA0040

Impact

  • T1486Data Encrypted for Impact

    Lynx uses AES-128 CTR mode for file encryption with RSA-2048 for key protection. Code similarities indicate it may be a rebrand or fork of INC Ransomware. Emerged mid-2024; highly aggressive targeting of SMBs and mid-market organizations across multiple sectors. Appends .lynx extension.

  • T1490Inhibit System Recovery

    Shadow copies deleted and recovery options disabled to prevent victim restoration.

Recent victims

No victims tracked yet.