Full Report
In this blog, we observed how the Lynx Ransomware-as-a-Service (RaaS) group operates, detailing the workflow of their affiliates within the panel, their cross-platform ransomware arsenal, customizable encryption modes, and advanced technical capabilities.
Analysis Summary
# Threat Actor: Lynx
## Attribution & Identity
* **Actor Name:** Lynx
* **Aliases:** Previously identified as **INC Ransom** (rebranded in July 2024).
* **Known Associations:** Operates as a Ransomware-as-a-Service (RaaS) group, utilizing a network of affiliates.
* **Identity:** While specific individuals are not named, the group operates a sophisticated affiliate panel and leak sites, positioning itself as a "professional" ransomware outfit.
## Activity Summary
Lynx emerged as a significant threat following its rebranding from INC Ransom in mid-2024. The group operates a RaaS model where they provide the encryption tools and infrastructure in exchange for a cut of the ransom. Recent operations involve the use of a cross-platform arsenal capable of targeting both Windows and Linux/ESXi environments. They are known for a "double extortion" strategy—exfiltrating sensitive data before encryption and threatening its release on their dedicated leak sites (lynxblog[.]net).
## Tactics, Techniques & Procedures
* **Affiliate Operations:** Utilizes a centralized panel for affiliates to manage victims, download customized builds, and coordinate negotiations.
* **Cross-Platform Encryption:** Employs ransomware written in C++ (Windows) and Go (Linux/ESXi), allowing for broad infrastructure impact.
* **Customizable Encryption Modes:** Affiliates can choose between "Fast" (partial encryption) and "Full" encryption modes to balance speed against the likelihood of data recovery.
* **Persistence & Lateral Movement:** While specific delivery vectors vary by affiliate, the group typically utilizes RDP exploitation, VPN credential theft, or phishing to gain initial access.
* **Inhibiting Recovery:** Deletion of Shadow Copies and system backups to force ransom payment.
* **Double Extortion:** Exfiltration of data via tools like Rclone or WinSCP prior to encryption.
**MITRE ATT&CK IDs (Inferred from workflow):**
* T1486: Data Encrypted for Impact
* T1021.001: Remote Services: Remote Desktop Protocol
* T1490: Inhibit System Recovery
* T1567: Exfiltration Over Web Service
## Targeting
* **Sectors:** Highly diversified; known to target Healthcare, Education, Manufacturing, and Government sectors.
* **Geography:** Global operations with a focus on North America (NA), Europe (EU), and Asia-Pacific (APAC).
* **Victims:** Specific organizations are listed on their Onion-based leak sites if ransom demands are not met.
## Tools & Infrastructure
* **Malware Families:**
* **Lynx Windows Encryptor:** C++ based ransomware.
* **Lynx Linux/ESXi Encryptor:** Go-based ransomware targeting virtual environments.
* **Infrastructure:**
* **Leak Site:** hxxp://lynxblog[.]net/
* **C2/Onion Domains:** Multiple .onion addresses used for victim communication (LynxChat) and data disclosure (LynxBlog).
* **Defanged Onion Examples:**
* hxxp://lynxblogco7r37jt7p5wrmfxzqze7ghxw6rihzkqc455qluacwotciyd[.]onion
* hxxp://lynxchatbykq2vycvyrtjqb3yuj4ze2wvdubzr2u6b632trwvdbsgmyd[.]onion
* hxxp://lynxad2seqpyu52lr5v7il4idasv23535a46s4bj65b3v7t5y6u5daqd[.]onion
## Implications
The rebranding from INC Ransom to Lynx suggests an evolution in their business model or an attempt to evade law enforcement scrutiny. Their advanced technical capabilities—specifically the ability to target ESXi environments and offer customizable encryption modes—indicate a highly mature threat actor. Their double-extortion tactics pose a significant risk of both operational downtime and regulatory/reputational damage due to data breaches.
## Mitigations
* **Implement Robust Backups:** Maintain offline, encrypted, and immutable backups. Regularly test restoration procedures.
* **Access Control:** Enforce Multi-Factor Authentication (MFA) on all external-facing services (VPNs, RDP).
* **Virtualization Security:** Harden VMware ESXi environments; ensure patches are up to date and management interfaces are not exposed to the internet.
* **Endpoint Protection:** Deploy EDR/XDR solutions to detect ransomware-linked behavior, such as Shadow Copy deletion or unauthorized use of Rclone.
* **Network Segmentation:** Restrict lateral movement by segmenting critical servers and sensitive data environments.