Campaign DetailSource-backed corpus

lynx Ransomware / Extortion Operations

Lynx is a ransomware-as-a-service operation that emerged in mid-2024 as a rebrand of INC Ransomware (whose source code was sold for $300,000 on the RAMP forum), claiming ~300 victims across manufacturing, business services, technology, and transportation with an 80/20 profit split for affiliates.

Last updated May 24, 2026, 8:00 PM EDT

Actor Mapping

Mapped Threat Actors

lynx

Targeting

Target Sectors / Countries

Cross-industry

Tradecraft

ATT&CK / Techniques

T1078T1566.001T1059.001T1036T1562.001T1003.001T1012T1082T1021.001T1567.002

Tools / Observables

Malware, Tools, CVEs

Ransom note or extortion communications

Source Reconciliation

How IntelliOS Is Treating This Campaign

Campaign rows are retained as source-backed context. Actor mappings do not automatically merge actor records; SOCRadar, MITRE, Mandiant, CrowdStrike, Microsoft, and other future sources can disagree on boundaries, aliases, or campaign ownership.

Ransomware group and victim claims are often adversary-controlled. Validate actor linkage, malware, and impact with incident evidence.

IntelliOS

Related Intel Products

None Found

Citations

Source Trust / Citations

[1] lynx - Ransomware.live group profileRansomware.live