Lynx ransomware emerged in July 2024, operating as a Ransomware-as-a-Service (RaaS) platform and is widely considered a rebranding or evolution of the INC ransomware group, sharing substantial portions of its source code. The group's primary motivation is financial, achieved through encrypting victim data and demanding ransom. Lynx differentiates itself by offering a highly organized RaaS platform with a structured affiliate program, providing resources and an 80% share of ransom proceeds. While claiming to avoid targeting healthcare and government sectors, the group primarily focuses on critical infrastructure, particularly energy, oil, and gas facilities, especially in the United States. Its operations involve a shift towards enhanced encryption methods and more refined attack techniques, expanding its victim base rapidly through its affiliate model.

Paises afectados

Sectores atacados

URLs nuevas detectadas en IntelTracker