Emerging Threat Actor: Lynx Ransomware

Lynx ransomware, which emerged on July 29th, 2024, has rapidly demonstrated its capabilities, executing over 22 attacks across the manufacturing and construction sectors by October.  

Operating under a Ransomware-as-a-Service (RaaS) model, Lynx utilizes both single and double extortion techniques, encrypting files while exfiltrating sensitive data to enhance its leverage.

There is speculations that Lynx is a rebranding of INC ransomware, as the similarity in their source code strongly suggests that Lynx has inherited or acquired INC’s malware infrastructure.

The group primarily targets Windows environments, appending the .lynx extension to encrypted files and erasing shadow copies to impede recovery. Its malware is highly customizable, allowing affiliates to execute commands via command-line arguments, granting them precise control over the files and directories to target.

Despite its claim to avoid attacks on government, healthcare, and non-profit organizations, Lynx’s operational strategy is designed to cause maximum disruption. The group primarily uses phishing campaigns and malicious downloads as initial infection vectors, exploiting various entry points into targeted networks.  

Victims who refuse to pay are listed on Lynx’s TOR-hosted leak site, where stolen data is made publicly available, heightening the pressure on the organization.

Recent Attacks:

• Myelec Electrical, a Western Australian company, was breached by Lynx ransomware, resulting in the exfiltration of confidential business information and personal details. Although specific details about the incident are scarce, Lynx has published screenshots as proof of the data theft.

• The Greenhouse People, a greenhouse manufacturing and sales company, was also attacked by Lynx. The group claims to have exfiltrated approximately 30GB of sensitive data, including an Active Directory dump, with a ransom demand of $18.1 million.

• Other Recent Ransomware Attacks by Lynx

Halcyon.ai eliminates the business impact of ransomware, drastically reduces downtime, prevents data exfiltration, and enables organizations to quickly and easily recover from attacks without paying ransoms or relying on backups – talk to a Halcyon expert today to find out more. Halcyon also publishes a quarterly RaaS and extortion group reference guide, Power Rankings: Ransomware Malicious Quartile.