Threat Group Profile
lynx
● Active — last 30 days
Victim claims
16
First seen
Mar 2026
Last activity
18 Jun 2026
Tracked since
—
Group overview
Lynx is a ransomware-as-a-service operation that emerged in mid-2024 as a rebrand of INC Ransomware (whose source code was sold for $300,000 on the RAMP forum), claiming ~300 victims across manufacturing, business services, technology, and transportation with an 80/20 profit split for affiliates.
Preferred targets
Healthcare · 3
Construction · 2
Consumer Services · 2
Manufacturing · 2
Technology · 2
Business Services · 1
Most targeted countries
US · 8
GB · 3
TW · 1
ES · 1
DE · 1
IN · 1
Tactics & techniques (MITRE ATT&CK)
Initial Access
Valid Accounts
Phishing: Spearphishing Attachment
Execution
Command and Scripting Interpreter: PowerShell
Defense Evasion
Masquerading
Disable or Modify Tools
Credential Access
OS Credential Dumping: LSASS Memory
Discovery
Query Registry
System Information Discovery
Lateral Movement
Remote Services: Remote Desktop Protocol
Exfiltration
Exfiltration Over Web Service: Exfiltration to Cloud Storage
Command and Control
Application Layer Protocol: Web Protocols
