Cat's Got Your Files: Lynx Ransomware
Essential information
- Published
- 17/11/2025 18:13
- Modified
- 18/11/2025 02:45
- Tags
- 2025-11-17 backup deletion credential abuse data exfiltration lateral movement lynx ransomware network reconnaissance ransomware rdp
- Related entities
- 7 observables, 17 techniques (mitre)
Description
A threat actor gained initial access to a network via RDP using compromised credentials, likely obtained through an infostealer, data breach, or initial access broker. They quickly moved laterally to a domain controller, created multiple impersonation accounts with high privileges, and installed AnyDesk for persistence. Over nine days, the actor conducted extensive network reconnaissance using SoftPerfect NetScan and NetExec, mapped virtualization infrastructure, and browsed file shares. They exfiltrated sensitive data from multiple shares using temp.sh. On the final day, the actor connected to backup servers, deleted backup jobs, and deployed Lynx ransomware across multiple servers. The intrusion lasted 178 hours and leveraged compromised domain admin credentials throughout.