Ransomware Group
Lynx
Lynx is a ransomware-as-a-service operation that emerged in mid-2024 as a rebrand of INC Ransomware (whose source code was sold for $300,000 on the RAMP forum), claiming ~300 victims across manufacturing, business services, technology, and transportation with an 80/20 profit split for affiliates.
Known victims417
Threat level
HIGH
Get an alert if one of your domains is named on a ransomware leak site.
Monitor your domainsFree account · up to 5 monitored targets
Tactics, Techniques & Procedures (TTPs)
DiscoveryEnum
- SoftPerfect NetScan
Exfiltration
- Restic
Known infrastructure
The following Tor hidden services have been associated with this group:
LynxLynxLynxLynxLynx
These sites are malicious. Open them only from an isolated environment.
Check if you’re affected
Look up your domain to see whether it appears on Lynx’s victim list.
Try it nowFree⌘K
Try
risk score · threat categories · sources · age · confidence — in one request