Ransomware.live: Lynx

| RaaS

Lynx is a ransomware-as-a-service operation that emerged in mid-2024 as a rebrand of INC Ransomware (whose source code was sold for $300,000 on the RAMP forum), claiming ~300 victims across manufacturing, business services, technology, and transportation with an 80/20 profit split for affiliates.

Victims

417

First Victim

2023-05-22

(est. attack date)

Discovery Date

2024-07-29

Last Seen

2026-08-29

Inactive Since

days

Avg Delay

27.6

days

Infostealer

31.2%

victims with domain

Countries

hit

Uptime

74.8% avg (30d)

View Victims on World Map View Group Statistics MITRE ATT&CK Navigator

Attack Velocity — Last 12 months (based on attack estimated date if available)

Known Locations (10)

Title	Available	Last Visit	FQDN
Lynx	No	2026-08-22T08:23:55	`lynxblog.net`
Lynx	No	2026-08-22T08:25:13	`lynxch2k5xi35j7hlbmwl7d6u2oz4vp2wqp6qkwol624cod3d6iqiyqd.onion`
Lynx	No	2026-11-03T06:10:05	`lynxchatly4zludmhmi75jrwhycnoqvkxb4prohxmyzf4euf5gjxroad.onion`
Lynx	No	2026-11-03T06:06:24	`lynxblogxstgzsarfyk2pvhdv45igghb4zmthnzmsipzeoduruz3xwqd.onion`
Lynx	No	2026-11-03T06:07:09	`lynxblogxutufossaeawlij3j3uikaloll5ko6grzhkwdclrjngrfoid.onion`
Lynx	No	2026-11-03T06:07:36	`lynxblogoxllth4b46cfwlop5pfj4s7dyv37yuy7qn2ftan6gd72hsad.onion`
Lynx	No	2026-11-03T06:08:26	`lynxblogmx3rbiwg3rpj4nds25hjsnrwkpxt5gaznetfikz4gz2csyad.onion`
Lynx	No	2026-11-03T06:08:47	`lynxblogco7r37jt7p5wrmfxzqze7ghxw6rihzkqc455qluacwotciyd.onion`
Lynx	No	2026-11-03T06:09:08	`lynxblogijy4jfoblgix2klxmkbgee4leoeuge7qt4fpfkj4zbi2sjyd.onion`
Lynx	No	2026-11-03T06:09:33	`lynxblogtwatfsrwj3oatpejwxk5bngqcd5f7s26iskagfu7ouaomjad.onion`

Target

Heatmap

Ransom Notes (2)

Tools Used

This information is provided by Ransomware-Tool-Matrix
Discovery	RMM Tools	Defense Evasion	Credential Theft	OffSec	Networking	LOLBAS	Exfiltration
SoftPerfect NetScan	placeholder	placeholder	placeholder	placeholder	placeholder	placeholder	Restic

TTPs Matrix (9)

This information is provided by Crocodyli & Ransomware.live
Initial Access	Execution	Defense Evasion	Credential Access	Discovery	Lateral Movement	Exfiltration	Command and Control	Impact
Valid Accounts	Command and Scripting Interpreter: PowerShell	Masquerading	OS Credential Dumping: LSASS Memory	Query Registry	Remote Services: Remote Desktop Protocol	Exfiltration Over Web Service: Exfiltration to Cloud Storage	Application Layer Protocol: Web Protocols	Data Encrypted for Impact
Phishing: Spearphishing Attachment		Disable or Modify Tools		System Information Discovery				Inhibit System Recovery

KQL Query (1)

YARA Rules (1)

Indicators of Compromise (IoCs) (20)

Email 1 Hash MD5 19

Type	IOC
`Email`	`martina.lestariid1898@proton.me`
`Hash MD5`	`0e521e0452f113cdf8b5c2fa6580db1f`
`Hash MD5`	`146d350fd6271b4411714c630d8cda87`
`Hash MD5`	`14a0ecf45aa72adb2b1f2ccca99f6faa`
`Hash MD5`	`2348b069647af0a714ae1e005f73b522`
`Hash MD5`	`30656c737338818bee8cc3591e3f3dcc`
`Hash MD5`	`31a77e0d1c1b91eebec1f7cdcc1ab8b8`
`Hash MD5`	`3a39bcd9fc840b4e13042f916d9eb39a`
`Hash MD5`	`571684f28ce1cf4d8236dbd46ef6f7f0`
`Hash MD5`	`57f45c0738af9cd49c61984ea99f83ca`
`Hash MD5`	`65c0c7c9fe6bc1d5296447aae6c6c14c`
`Hash MD5`	`67a44a38cc36becd6e2e9c20c27fd9ad`
`Hash MD5`	`74ae58a716aa834949388ee1574788e0`
`Hash MD5`	`7e851829ee37bc0cf65a268d1d1baa7a`
`Hash MD5`	`a20886a5b378624d16972db66bd4e7e1`
`Hash MD5`	`b1d81e8bbecccc547645d17395538a2d`
`Hash MD5`	`b47cdcdc179c5949ce18f4d161603901`
`Hash MD5`	`d972bbbb3edb0e5ab5751b911f3dda17`
`Hash MD5`	`f16238836909d07f86154c5ccbade96a`
`Hash MD5`	`ff458208c49836cdec92f0a4a7ba6afd`

Victims (417)

cutlercapital