Loading story…
Researchers mapped the Lynx ransomware operation across multiple generations of Tor leak sites, negotiation portals, and victim communication channels, identifying 397 indexed victims between July 2024 and August 2026. The investigation linked historical leak pages, recurring ProtonMail addresses, malware-associated hidden services, and at least 14 additional Tor domains plus 16 more hidden services that followed the group’s naming patterns, indicating a structured and persistent ransomware infrastructure. Lynx has presented itself as a financially motivated group, but that claim remains unverified actor messaging.
Separate technical analysis describes Lynx as a ransomware-as-a-service operation that emerged in mid-2024 and appears related to the INC ransomware family, targeting sectors including finance, manufacturing, construction, and energy with double extortion. The malware reportedly encrypts files with AES in parallel threads, stores its ransom note in Base64, mounts hidden drives, changes wallpapers, prints ransom notes, and inhibits recovery by deleting Volume Shadow Copies, behavior aligned with MITRE ATT&CK technique T1490. That recovery-blocking tactic is widely associated with modern ransomware because it reduces victims’ ability to restore encrypted systems without paying.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
StealthMole historical records showed the current Lynx hidden service was still active as of 11 August 2026.
StealthMole historical records first observed the current Lynx leak-site hidden service on 20 August 2024.
StealthMole reports that one of the earliest indexed Lynx victim entries was published in August 2024, indicating public victim listings had begun by then.
StealthMole's ransomware monitoring indexed 397 Lynx victims between July 2024 and August 2026, showing sustained campaign activity over that period.
The ISH article states that the Lynx ransomware group emerged in mid-2024 and began operating as a ransomware-as-a-service scheme.
The ISH analysis describes Lynx as an evolution of the INC ransomware family and states that INC emerged in mid-2023.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 54 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
stealthmole-intelligence-hub.blogspot.com
Open sourceish.com.br
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks Unit 42 reported that the **Lynx** ransomware operation has emerged as a rebranding of **INC Ransomware**, indicating continuity rather than the appearance of a wholly new threat actor. The report links Lynx to INC through overlapping operational characteristics and branding changes, suggesting the group has shifted identity while maintaining its ransomware activity. The rebrand matters for defenders because it can obscure attribution, complicate tracking of victimology and tactics, and create the impression of a new entrant in the ransomware ecosystem. Security teams should treat **Lynx** and **INC Ransomware** as closely connected in threat intelligence, detection, and incident response workflows while monitoring for continued evolution in infrastructure, tooling, and extortion operations.
Jul 12, 2026
Reporting highlights a broader shift in the ransomware ecosystem toward **platform-like operations** and **ransomware-as-a-service (RaaS)** models that lower the barrier to entry and accelerate the creation of new crews. Huntress telemetry for 2025 is cited as placing **Akira** as a leading ransomware group, with operators increasingly targeting the **hypervisor layer** to bypass traditional endpoint controls; separate commentary describes rapid victim growth for **Qilin** (claimed to exceed 1,000 victims in 2025) and notes **LockBit** regaining operational capability after prior disruption. The same reporting also points to “**Extortion-as-a-Service**” offerings (including a federation described as **SLSH**—Scattered Spider/Lapsus$/ShinyHunters) that enable affiliates to rent tooling rather than develop it, contributing to a surge in newly formed groups. A separate technical write-up details **Termite** ransomware as a Babuk-derived operation first observed in late 2024 that has matured into a multi-stage intrusion and **double-extortion** threat, claiming dozens of victims across multiple sectors and regions by March 2026. The report emphasizes Termite’s operationalization of **ClickFix** (browser-based social engineering) to bypass traditional phishing defenses, and provides a distinctive forensic marker: encrypted files reportedly have the Babuk-inherited trailing string `"choung dong looks like hot dog"`, positioned as a practical indicator during triage. Another overview article catalogs major active ransomware groups and tactics, including **Lynx** (described as sharing substantial code with INC, using double extortion, appending `.lynx`, and deleting shadow copies) and **Medusa**, while reiterating law-enforcement attribution and indictments tied to **LockBit** leadership and deployment activity.
Jun 29, 2026
Ransomware reporting in early February highlighted both broad **January 2026** activity and specific new developments. BlackFog tracked **91 publicly disclosed ransomware attacks** to open 2026, with **healthcare** the most targeted sector (27 incidents) and nearly **half (49%)** of recorded attacks not publicly claimed by a known group; among claimed activity, **Qilin** led with eight incidents and the **U.S.** accounted for 58% of disclosed attacks. Separately, CYFIRMA reported identifying a ransomware strain dubbed **Milkyway**, which encrypts files and appends the `.milkyway` extension, presents a full-screen ransom message, and uses typical extortion pressure (including threats to leak stolen data), with recovery generally dependent on offline/secure backups absent cryptographic flaws. A healthcare-specific incident in Ontario was also disclosed: **Lakelands Public Health** reported a cybersecurity intrusion discovered **Jan 29** and reported **Feb 3**, which disrupted internal systems and some public services during containment while stating infectious disease and clinical appointment systems were not impacted. The **Lynx** ransomware group publicly claimed responsibility by listing the organization on a leak site and implying data theft; Lakelands Public Health engaged a specialized cybersecurity firm and worked with law enforcement and forensics to validate the claim and determine scope. UpGuard characterized Lynx as a **RaaS** operation and an alleged successor to the **INC** ransomware group, consistent with double-extortion tactics (encryption plus threatened data exposure).
Jun 29, 2026