Lynx Ransomware: A Rebranding of INC Ransomware
Essential information
- Published
- 14/10/2024 10:18
- Modified
- 14/10/2024 10:45
- Tags
- 2024-10-14 data leak double-extortion encryption inc ransomware linux lynx ransomware raas ransomware windows
- Related entities
- 44 observables, 1 intrusion sets (apt), 15 techniques (mitre), 2 malware, 5 others
Description
Lynx ransomware, discovered in July 2024, is a successor to INC ransomware targeting organizations in retail, real estate, architecture, and financial services in the U.S. and UK. It shares significant source code with INC and operates as a ransomware-as-a-service model. Lynx employs double extortion tactics, exfiltrating data before encryption. The group uses various delivery mechanisms, including phishing emails and malicious downloads. Technical analysis reveals the use of AES-128 and Curve25519 encryption algorithms, with files appended with a .lynx extension. The ransomware terminates specific processes, encrypts network drives, and uses the Restart Manager API to target locked files. Comparison with INC ransomware shows a 70.8% overlap in shared functions, indicating code reuse.