Loading malware…
Lynx ransomware is a ransomware family first observed in 2024 and described as a new strain seen in active intrusions. Reporting in the provided content assesses it as part of the lineage that evolved from the INC Ransomware family, and later reporting states Sinobi is likely a rebrand or successor of Lynx. Technical comparison cited in the content found 63.2% function similarity between Lynx and Sinobi binaries, indicating substantial code overlap and likely shared tooling or source lineage.
The malware uses a hybrid cryptographic scheme, specifically AES-128 in CTR mode for file encryption and Curve25519 Donna/Curve25519 for asymmetric key exchange. In related reporting on the successor/rebrand activity, the ransomware is described as using per-file keys generated via CryptGenRandom, terminating processes associated with SQL Server, backup services, and Microsoft Exchange to unlock files for encryption, deleting Volume Shadow Copies, clearing the Recycle Bin, mounting hidden drives, and modifying the desktop wallpaper. The related family drops a README.txt ransom note with Tor-based negotiation instructions and a typical seven-day deadline.
Observed intrusion activity associated with Lynx includes deployment after initial access via valid compromised RDP credentials to an internet-exposed host. In the documented March 2025 intrusion, the actor laterally moved via RDP, created privileged look-alike accounts for persistence, performed network discovery with native tools and SoftPerfect Network Scanner, used NetExec for SMB enumeration/password spraying, collected data from network shares, compressed it with 7-Zip, exfiltrated it via temp.sh, deleted Veeam backup jobs, and then deployed Lynx ransomware across multiple backup and file servers via RDP. The payload in that case was named w.exe and was executed with arguments including "--dir E:\ --mode fast --verbose --noprint". Another mention states operators deleted backup jobs and deployed Lynx across multiple backup and file servers via RDP.
The content indicates Lynx is associated with double-extortion tradecraft through its assessed successor/rebrand, including data theft prior to encryption and pressure via Tor-based leak infrastructure. Targeting described in the provided material for the related operation includes medium-to-large organizations, especially where downtime is critical, with victims in manufacturing, healthcare, financial services, and education, and many victims in the United States. High-confidence observables directly mentioned for Lynx include the payload name w.exe in one intrusion and use of RDP for deployment; related lineage reporting also references generic payload names such as bin.exe and README.txt ransom notes.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
22 distinct techniques documented for this family, organized by ATT&CK tactic.
Discovery T1057 Process Discovery Detecta e, se configurado com a flag --stop-processes , encerra processos específicos durante a execução do ataque.
Discovery T1082 System Information Discovery Coleta informações do sistema, como a quantidade de núcleos da CPU, com o objetivo de otimizar a criação de múltiplas threads.
Discovery T1083 File and Directory Discovery Utiliza APIs do Windows para percorrer recursivamente diretórios e identificar arquivos para criptografia.
“The intrusion began with a single successful Remote Desktop Protocol (RDP) logon to an internet-exposed system… the threat actor moved laterally to a domain controller via RDP… deployed Lynx ransomware… across multiple backup and file servers via RDP.”
Impact T1486 Data Encrypted for Impact Utiliza o algoritmo AES para criptografar os arquivos do sistema, exigindo pagamento de resgate para a restauração dos dados.
Impact T1489 Service Stop Se configurado com a flag --kill , finaliza serviços e processos específicos para facilitar a criptografia de arquivos em uso.
Assim, o Lynx implementa de maneira peculiar a técnica de Impacto Inhibit System Recovery [T1490] do MITRE ATT&CK, de maneira que evade qualquer tentativa de implementar uma detecção através de Logs.
64 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
RaaS ransomware family assessed in the content as the immediate predecessor/rebrand lineage for Sinobi, with substantial code similarity indicating shared tooling/source.
Referenced as the ransomware family/group that Sinobi may have rebranded or splintered from; no additional technical details provided in the content.
Ransomware deployed manually via RDP. The payload ("w.exe") was dropped to servers and executed with arguments such as "--dir E:\ --mode fast --verbose --noprint" to encrypt targeted directories (noted as partial/fast encryption).
Ransomware using hybrid cryptography (AES-128 CTR + Curve25519 key exchange) and double-extortion; described as having an affiliate platform/tooling consistent with RaaS operations.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.