Threat Research

The Lynx ransomware intrusion began with an RDP login using stolen credentials, quickly followed by lateral movement to a domain controller using a compromised admin account. The attacker created multiple impersonation-style privileged accounts, mapped virtualization systems and file shares, and gathered sensitive data before exfiltrating it via temp.sh....

The "Ransomware Roundup – Lynx" reveals that the first sample of Lynx ransomware surfaced in early July 2024, coinciding with other reports of its availability. Research shows that Lynx shares similarities with the earlier INC ransomware, which debuted in July 2023. While INC ransomware offers fewer execution options, it appears to be a predecessor to Lynx....

"Lynx on the Prowl: Targeting SMBs with Double-Extortion Tactics" examines the emergence of the Lynx ransomware group, which has rapidly targeted over 25 small and medium-sized businesses (SMBs) in North America and Europe since its debut in mid-July 2023....