Lynx Ransomware — Ransomware Profile
Lynx emerged mid-2024, assessed as rebrand of INC Ransom built on shared source code. Nearly 180 victims by end of 2024. Professional affiliate panel. Among top 10 ransomware groups of 2025. Targets utilities, construction, and manufacturing.Also tracked as
Lynx
IntelFusions coverage (1)
- DeadLock ransomware wipes logs and throttles to stay hidden 2026-08-10 · Ransomware
Tools & malware
- Lynx Encryptor Ransomware
- PsExec Lateral Movement
- WMIC Execution
Recent claimed victims
- cutlercapital 2026-08-29
- Jerry Leigh 2026-08-06
- Talbot County Department of Emergency Services 2026-08-06
- Wolf Construction Services, Inc 2026-06-18
- Easterseals Iowa 2026-06-18
- Southern Mechanical Contractors 2026-06-18
- CommonWealth Partners Properties 2026-06-11
- Bay Area Herbs & Specialties 2026-05-10
- CSB Energy Technology Co., Ltd. 2026-05-10
- OS Sistemes 2026-05-10
- Funky Chunky 2026-05-10
- St Anne's Catholic School & Sixth Form College 2026-05-10
- Lifelong Access 2026-05-10
- Jackson County Visitor Center 2026-05-10
- Kurita Europe 2026-05-10
- Stonehenge 2026-04-14
- Sentry Dynamics, Inc. 2026-04-13
- CW&W Contractors 2026-04-13
- ACNHealthcare 2026-04-08
- www.smithdollar.com 2026-04-07
- NJ Pain Care Specialists 2026-03-26
- Industrial Rubber Supply 2026-03-14
- Africa Insurance 2026-03-13
- Keller Polska 2026-03-13
- Hegelmann Group 2026-03-01
Vendor research
- Ransomware Roundup - Lynx Fortinet FortiGuard Labs
- Protection Bulletin: Lynx Ransomware Symantec (Broadcom)
- MSPs a top target for Akira and Lynx ransomware Acronis Threat Research Unit
- Lynx Ransomware: Emerging RaaS Operation Rapid7
- Lynx Ransomware: Successor to INC Ransom Palo Alto Networks
- Lynx Ransomware: New Player in the RaaS Arena Group-IB