Lynx
A ransomware-as-a-service operation that appeared in 2024 and shares much of its code with INC ransomware. Reported intrusions rely on valid credentials and remote access rather than rare exploits, and end with data theft, backup destruction and encryption.
Threat actor profile. Last reviewed 3 November 2026.
Why It Matters
Unit 42 found that Lynx shares a significant portion of its source code with INC ransomware, and calls it a successor. It also notes that INC source code was offered for sale from March 2024, which could explain the overlap.1 Darktrace likewise suggests the group may have acquired and adapted that code.4 Code reuse does not prove the same people are behind both.
The most detailed public case came from The DFIR Report. An attacker logged in to an exposed RDP server with valid credentials, spent nine days moving through the network, deleted Veeam backup jobs and records, then ran the ransomware.3 That makes credential hygiene and backup separation the main controls to check.
Unit 42 named the US and UK among the countries of early victims,1 and Triskele Labs says the group has been especially active in the US, Europe, the UK and Australia.2 In July 2026, SOCRadar told BleepingComputer that the FortiBleed credential theft campaign against FortiGate firewalls was tied to members of Lynx and INC. Its evidence centres on one individual with access to both groups' negotiation panels, and it has not yet published all of it.5
Because Lynx access often starts with credentials that are already valid, we would treat exposed RDP, VPNs without strong MFA and RMM accounts as the priority, along with any FortiGate credentials that may have been exposed.
How It Attacks
Based mainly on one March 2025 intrusion described by The DFIR Report,3 with access routes from Triskele Labs2 and Darktrace.4 Affiliates vary, so this is a typical pattern and not a fixed script.
- 1
Log In With Valid Credentials
Uses valid credentials on exposed RDP, SSL VPNs with permissive settings, or RMM platforms without MFA. Darktrace also cites phishing as a route.
- 2
Reach a Domain Controller
Moves to a domain controller using a separately compromised domain admin account, in the DFIR case within about ten minutes.
- 3
Create Look-Alike Admins
Creates look-alike accounts with passwords that never expire and adds them to privileged groups.
- 4
Map the Network
Uses built-in Windows tools, network scanners and NetExec to find shares, hypervisors and backup servers.
- 5
Take the Data
Archives file server data and uploads it to file-sharing or cloud storage services.
- 6
Remove Backups, Then Encrypt
Deletes backup jobs and records, then runs the ransomware over RDP against backup and file servers.
Key Techniques
ATT&CK v20 has no group entry for Lynx. This mapping is ours, based on The DFIR Report,3 Darktrace4 and Triskele Labs.2
| ID | Technique | Tactic | What It Looks Like |
|---|---|---|---|
| T1133 | External Remote Services | Initial Access | Logs in through exposed RDP and VPN services. |
| T1078 | Valid Accounts | Initial Access | Uses credentials obtained before the intrusion. |
| T1136.002 | Domain Account | Persistence | Creates look-alike domain accounts and adds them to privileged groups. |
| T1021.001 | Remote Desktop Protocol | Lateral Movement | Moves between hosts over RDP. |
| T1219.002 | Remote Desktop Software | Command and Control | Has used AnyDesk and RMM tooling. |
| T1560.001 | Archive via Utility | Collection | Archives file server folders with 7-Zip. |
| T1567 | Exfiltration Over Web Service | Exfiltration | Uploads archives to file-sharing or cloud storage services. |
| T1490 | Inhibit System Recovery | Impact | Deletes shadow copies, backup jobs and backup records. |
| T1486 | Data Encrypted for Impact | Impact | Encrypts files on servers and network shares. |
Tools Observed
Remote Access
Discovery and Movement
Credential Theft and Post-Exploitation
Data Theft
Tool lists come from The DFIR Report,3 Darktrace4 and Triskele Labs.2 Many are legitimate products, so check whether a tool is approved and expected.
Key Events
Lynx is discovered and publishes a statement on its leak site.1
Unit 42 publishes its analysis of the code overlap with INC.1
Intrusion later documented by The DFIR Report.3
SOCRadar's FortiBleed findings are reported, linking the campaign to members of Lynx and INC.5 Triskele Labs publishes its profile, listing the group as active.2
Warning Signs
Drawn from The DFIR Report's defender takeaways.3 None of these proves an attack alone.
- Logons with valid accounts from unfamiliar sources
- New members of privileged groups, especially look-alike account names
- NetScan or NetExec running on servers
- Large archives created and then uploaded to file-sharing sites
- Backup jobs or records deleted from the backup console
Defences That Matter
Lock Down Remote Access
- Remove RDP from the internet where possible.
- Require MFA on VPN and RMM accounts, as Triskele Labs saw footholds where it was missing.2
- Check that VPN access is not open to every domain user.2
Protect the Backups
- Use separate credentials and immutable copies for backup infrastructure.3
- Test restoring without the backup console.
Watch for Early Moves
- Alert on new privileged group members and look-alike accounts.3
- Monitor scanning tools and large outbound transfers.3
Could a Stolen Login Reach Your Backups?
We can test your remote access and backup controls against the methods in this profile and help you close the gaps.
Sources
- Unit 42, Palo Alto Networks: Lynx Ransomware: A Rebranding of INC Ransomware, 10 October 2024
- Triskele Labs: New Name, Same Threat: How Lynx Ransomware Exploits Trusted Access, 31 July 2026
- The DFIR Report: Cat's Got Your Files: Lynx Ransomware, 17 December 2025
- Darktrace: New Threat on the Prowl: Investigating Lynx Ransomware, 27 February 2025
- BleepingComputer: FortiBleed credential-theft campaign linked to Lynx ransomware, 1 July 2026
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK terms of use.