Loading story…
Palo Alto Networks Unit 42 reported that the Lynx ransomware operation has emerged as a rebranding of INC Ransomware, indicating continuity rather than the appearance of a wholly new threat actor. The report links Lynx to INC through overlapping operational characteristics and branding changes, suggesting the group has shifted identity while maintaining its ransomware activity.
The rebrand matters for defenders because it can obscure attribution, complicate tracking of victimology and tactics, and create the impression of a new entrant in the ransomware ecosystem. Security teams should treat Lynx and INC Ransomware as closely connected in threat intelligence, detection, and incident response workflows while monitoring for continued evolution in infrastructure, tooling, and extortion operations.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
Palo Alto Networks Unit 42 published research assessing Lynx ransomware as a rebranding of the INC Ransomware operation, marking a new attribution development in the threat's evolution.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers mapped the **Lynx** ransomware operation across multiple generations of Tor leak sites, negotiation portals, and victim communication channels, identifying **397 indexed victims** between July 2024 and August 2026. The investigation linked historical leak pages, recurring ProtonMail addresses, malware-associated hidden services, and at least **14 additional Tor domains** plus **16 more hidden services** that followed the group’s naming patterns, indicating a structured and persistent ransomware infrastructure. Lynx has presented itself as a financially motivated group, but that claim remains unverified actor messaging. Separate technical analysis describes Lynx as a **ransomware-as-a-service** operation that emerged in mid-2024 and appears related to the **INC** ransomware family, targeting sectors including finance, manufacturing, construction, and energy with **double extortion**. The malware reportedly encrypts files with AES in parallel threads, stores its ransom note in Base64, mounts hidden drives, changes wallpapers, prints ransom notes, and inhibits recovery by deleting **Volume Shadow Copies**, behavior aligned with MITRE ATT&CK technique `T1490`. That recovery-blocking tactic is widely associated with modern ransomware because it reduces victims’ ability to restore encrypted systems without paying.
Aug 15, 2026
INC ransomware has grown into one of the most active **ransomware-as-a-service** operations, with researchers attributing its rise to aggressive affiliate expansion, broad victim targeting, and effective use of established intrusion methods rather than novel exploits. The group, active since 2023 and linked to more than **800 claimed victims**, uses **double extortion** by encrypting systems and threatening to leak stolen data, with early concentration on healthcare and other high-pressure sectors now expanding into education, legal, manufacturing, construction, and technology organizations. Researchers said INC has upgraded both its **Windows** and **Linux/ESXi** encryptors by rewriting them in **Rust**, improving cross-platform operations and resilience while affiliates continue to rely on spearphishing, stolen credentials, and exploitation of known flaws including **Citrix Bleed 2**, **Citrix NetScaler**, **SimpleHelp RMM**, and **Fortinet EMS** vulnerabilities. Post-compromise activity has included abuse of legitimate remote administration tools, credential theft from **Veeam** environments, living-off-the-land lateral movement, use of EDR killers, and cloud-based exfiltration with tools such as **rclone**; analysts also linked INC code to related strains including **Lynx**, **Sinobi**, and **Knoba** after the group’s source code was reportedly sold to multiple parties.
Jul 23, 2026
Researchers published new intelligence on **INC Ransom**, outlining a victim negotiation platform allegedly exposed at `178.20.41.208:1002` and describing a stack built on **nginx**, **Yii/PHP**, and a **React/Redux/Socket.io** frontend. The reporting says the group’s infrastructure spans clear-web and onion sites with repeated overlap in Russian hosting, and that INC has operated since 2023, listed more than **870 victims**, and may share code or branding lineage with **Lynx** and possibly **Sinobi**. Separate technical reporting described INC as a **multi-extortion** operation that primarily targets healthcare, industrial, and education organizations in the U.S. and Europe, using living-off-the-land tools such as **NETSCAN.EXE**, **AnyDesk**, and `SystemSettingsAdminFlows.exe`, along with Defender tampering and a custom `av.exe` utility to disable EDR protections. At the same time, multiple new victim claims attributed to **incransom** surfaced, affecting organizations in nonprofit services, manufacturing, healthcare support, and other sectors across the **United States, Mexico, and Switzerland**. Reported victims included **Foundations to Freedom** in Florida, **DUCON** in Colorado, **minigrip.com.mx** in Mexico, **Della Casa Group AG** in Switzerland, and a Minnesota-based residential care provider associated with **eclmn.com**. The victim summaries describe unauthorized access to confidential files including client data, financial records, R&D material, and project information; in the Swiss case, the leak allegedly involved **86,332 files** in **15,359 folders** totaling about **240 GB**, underscoring INC Ransom’s continued emphasis on data theft and public leak pressure alongside encryption.
Jul 29, 2026