Lynx is a ransomware-as-a-service operation rebranded from INC Ransomware, targeting healthcare and manufacturing sectors.
Analyst brief
Lynx is a ransomware-as-a-service operation that emerged in mid-2024 as a rebrand of INC Ransomware. It primarily targets the healthcare, manufacturing, and professional services sectors in the United States and the United Kingdom. Key TTPs include customized ransomware payloads based on the source code sold on the RAMP forum and an 80/20 profit-sharing model for affiliates. Defenders should focus on detecting tailored ransomware executions and likely accompanying data exfiltration attempts.
lynx
activecrime
Lynx is a ransomware-as-a-service operation that emerged in mid-2024 as a rebrand of INC Ransomware (whose source code was sold for $300,000 on the RAMP forum), claiming ~300 victims across manufacturing, business services, technology, and transportation with an 80/20 profit split for affiliates.