RansomwareSOCRadar source-of-truth import; pending cross-source consensus confidenceSynced actor recordProfile updated Jul 05, 2026, 3:37 AM EDT

Lynx

Lynx ransomware first came to public attention with documented activity on 2026-05-10, operating as a **Ransomware-as-a-Service (RaaS)** platform. Its primary motivation is financial exploitation, targeting critical infrastructure sectors, especially **energy, oil, and gas facilities**. Lynx notably evolved from the INC ransomware, evidenced by shared source code and the incorporation of enhanced encryption methods and refined attack techniques. The group's operational model is distinct, featuring a structured affiliate program that provides comprehensive resources, an intuitive dashboard, and an 80% share of ransom proceeds, while centralizing control over negotiations and ransom wallet management.

This profile is generated from the same canonical actor-card record used by the Threat Actor Cards directory, so aliases, targeting fields, activity notes, and source links stay aligned as the database is enriched.

Actor Card Detail

Canonical Profile Fields

Entity Type¹

Ransomware profile

First Seen¹

2026-05-10

Last Seen¹

2026-05-10

Profile Updated¹

Jul 05, 2026, 3:37 AM EDT

Victim Count^1,2

Not available

Origin¹

Unknown

Motivation¹

Financially motivated ransomware/extortion

Primary Access Pattern¹

T1078 - Valid Accounts

Objective¹

Financially motivated ransomware/extortion

Identity

Aliases And Boundaries

Aliases¹

Lynx Locker

Source Boundary

SOCRadar is the retained baseline for this profile. IntelliOS preserves source labels as discovery and comparison signals until a cited source explicitly supports a merge, split, or actor-boundary change.

Targeting

Targets, Activity, And ATT&CK

Target Countries / Exposure^1,2

Not available

Target Sectors^1,2

Construction of BuildingsFood ManufacturingSoftware PublishersReal EstateHospitalsEnterprises & HoldingAccommodationAir TransportationManufacturingConstructionElectrical Equipment, Appliance, and Component ManufacturingPublic AdministrationAdministrative &Waste ManagementOil & GasEducational ServicesWholesale TradeTextile & Fabric ManufacturingRestaurantsEnergy & UtilitiesInsurancePharmaceutical and Medicine ManufacturingCrop ProductionPaper ManufacturingFabricated Metal Product ManufacturingPerforming Arts, Spectator Sports, and Related IndustriesPlastics Product ManufacturingMotor Vehicle ManufacturingMotor Vehicle Parts ManufacturingLumber and Other Construction Materials Merchant WholesalersBuilding Material and Supplies DealersMotion Picture and Video IndustriesAutomotiveLegal ServicesSpecialized Design ServicesManagement, Scientific, and Technical Consulting ServicesScientific Research and Development ServicesRemediation and Other Waste Management ServicesColleges, Universities, and Professional SchoolsBusiness Schools and Computer and Management TrainingEducational Support ServicesOffices of PhysiciansOutpatient Care CentersMedical and Diagnostic LaboratoriesHome Health Care ServicesIndividual and Family ServicesPromoters of Performing Arts, Sports, and Similar EventsIndependent Artists, Writers, and PerformersMuseums, Historical Sites, and Similar InstitutionsOther Amusement and Recreation IndustriesCommercial and Industrial Machinery and Equipment (except Automotive and Electronic) Repair and MaintenancePersonal Care ServicesOther Personal ServicesReligious OrganizationsGrantmaking and Giving ServicesCivic and Social OrganizationsBusiness, Professional, Labor, Political, and Similar OrganizationsJustice, Public Order, and Safety ActivitiesPaper Bag and Coated and Treated Paper ManufacturingMedical Equipment and Supplies ManufacturingOther Chemical and Allied Products Merchant WholesalersNew Car DealersElectronics and Appliance StoresSupermarkets and Other Grocery (except Convenience) StoresFamily Clothing StoresJewelry StoresGeneral Merchandise Stores, including Warehouse Clubs and SupercentersUrban Transit SystemsFreight Transportation ArrangementPeriodical PublishersMotion Picture and Video ProductionWired and Wireless Telecommunications CarriersData Processing, Hosting, and Related ServicesAll Other Information ServicesInvestment Banking and Securities DealingMiscellaneous IntermediationOffice Machinery and Equipment Rental and LeasingEngineering ServicesGraphic Design ServicesComputer Systems Design and Related ServicesManagement Consulting ServicesEnvironmental Consulting ServicesAdvertising AgenciesPublic Relations AgenciesTranslation and Interpretation ServicesFacilities Support ServicesEmployment Placement Agencies and Executive Search ServicesTelephone Call CentersInvestigation, Guard, and Armored Car ServicesConvention and Trade Show OrganizersPublishing ServicesAccommodation&Food ServicesChemical&Pharmaceutical ManufacturingMiningTruck&Rail TransportationCivic&Social OrganizationsTelecommunicationsTransportation&WarehousingRetailAgriculture&ForestryElectrical&Electronical ManufacturingSea TransportationInformation ServicesComputer Design & ServicesOtherFinanceE-CommerceProfessional&Technical ServicesHealthCare & Social AssistanceArts & EntertainmentRental & LeasingDelivery ServicesAdministrative & Support ServicesArchitectural ServicesCouriers and Express Delivery ServicesHotels (except Casino Hotels) and MotelsHuman Resources Consulting ServicesIndustrial Machinery and Equipment Merchant WholesalersNational SecurityOffices of Certified Public AccountantsOffices of LawyersTour OperatorsTravel AgenciesComputer Systems Design Services

Associated Activity¹

Initial Access: Phishing and Social EngineeringDefense Evasion: Process and Service TerminationExfiltration: Data Exfiltration

ATT&CK IDs¹

T1078 - Valid AccountsT1486 - Data Encrypted for ImpactT1566 - PhishingT1027 - Obfuscated Files or Information

Campaign Context

Associated Campaigns / Operations

Campaign / Operation	Source-Backed Context
FortiBleed Credential Exposure Campaign^11,8,9,10	FortiBleed Credential Exposure Campaign is retained in the campaign database for INC Ransom. FortiBleed is retained as a Fortinet/FortiGate credential-exposure campaign in which public reporting tied exposed or stolen Fortinet edge credentials to downstream ransomware activity involving INC Ransom and Lynx. IntelliOS treats FortiBleed as a campaign/operation context rather than proof that every exposed Fortinet environment was compromised or deployed with ransomware.
lynx Ransomware / Extortion Operations¹²	lynx Ransomware / Extortion Operations is retained in the campaign database for lynx. Lynx is a ransomware-as-a-service operation that emerged in mid-2024 as a rebrand of INC Ransomware (whose source code was sold for $300,000 on the RAMP forum), claiming ~300 victims across manufacturing, business services, technology, and transportation with an 80/20 profit split for affiliates.

Campaign / Operation

Source-Backed Context

FortiBleed Credential Exposure Campaign^11,8,9,10

FortiBleed Credential Exposure Campaign is retained in the campaign database for INC Ransom. FortiBleed is retained as a Fortinet/FortiGate credential-exposure campaign in which public reporting tied exposed or stolen Fortinet edge credentials to downstream ransomware activity involving INC Ransom and Lynx. IntelliOS treats FortiBleed as a campaign/operation context rather than proof that every exposed Fortinet environment was compromised or deployed with ransomware.

lynx Ransomware / Extortion Operations¹²

lynx Ransomware / Extortion Operations is retained in the campaign database for lynx. Lynx is a ransomware-as-a-service operation that emerged in mid-2024 as a rebrand of INC Ransomware (whose source code was sold for $300,000 on the RAMP forum), claiming ~300 victims across manufacturing, business services, technology, and transportation with an 80/20 profit split for affiliates.

Indicators

IOCs And Observable Retention

SOCRadar reported 767²IntelliOS retained 94^{2,3,4,5,6,7,8,9,10}

SOCRadar reports 767 IOCs for this profile. IntelliOS currently retains 94 cited public observable/context rows; this is not the full possible public-source IOC corpus.

Source coverage: 12 source groups tracked; 11 currently contribute retained observable or context rows.

Retained Observables

Showing 60 of 94

Type	Value	Source
SHA-256 Hash	31de5a766dca4eaae7b69f807ec06ae14d2ac48100e06a30e17cc9acccfd5193⁵	Ransomware Roundup
SHA-256 Hash	3e68e5742f998c5ba34c2130b2d89ca2a6c048feb6474bc81ff000e1eaed044e⁵	Ransomware Roundup
SHA-256 Hash	432f549e9a2a76237133e9fe9b11fbb3d1a7e09904db5ccace29918e948529c6⁵	Ransomware Roundup
SHA-256 Hash	468e3c2cb5b0bbc3004bbf5272f4ece5c979625f7623e6d71af5dc0929b89d6a⁵	Ransomware Roundup
SHA-256 Hash	4e5b9ab271a1409be300e5f3fd90f934f317116f30b40eddc82a4dfd18366412⁵	Ransomware Roundup
SHA-256 Hash	571f5de9dd0d509ed7e5242b9b7473c2b2cbb36ba64d38b32122a0a337d6cf8b⁵	Ransomware Roundup
SHA-256 Hash	589ff3a5741336fa7c98dbcef4e8aecea347ea0f349b9949c6a5f6cd9d821a23⁵	Ransomware Roundup
SHA-256 Hash	80908a51e403efd47b1d3689c3fb9447d3fb962d691d856b8b97581eefc0c441⁵	Ransomware Roundup
SHA-256 Hash	85699c7180ad77f2ede0b15862bb7b51ad9df0478ed394866ac7fa9362bf5683⁵	Ransomware Roundup
SHA-256 Hash	97c8f54d70e300c7d7e973c4b211da3c64c0f1c95770f663e04e35421dfb2ba0⁵	Ransomware Roundup
SHA-256 Hash	9a47ab27d50df1faba1dc5777bdcfff576524424bc4a3364d33267bbcf8a3896⁵	Ransomware Roundup
SHA-256 Hash	b378b7ef0f906358eec595777a50f9bb5cc7bb6635e0f031d65b818a26bdc4ee⁵	Ransomware Roundup
SHA-256 Hash	d5ca3e0e25d768769e4afda209aca1f563768dae79571a38e3070428f8adf031⁵	Ransomware Roundup
SHA-256 Hash	eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc⁵	Ransomware Roundup
SHA-256 Hash	ecbfea3e7869166dd418f15387bc33ce46f2c72168f571071916b5054d7f6e49⁵	Ransomware Roundup
SHA-256 Hash	f71fc818362b1465fc1deb361de36badc73ac4dd9e815153c9022f82c4062787⁵	Ransomware Roundup
Filename	README.txt⁵	Ransomware Roundup
File Extension	.LYNX⁵	Ransomware Roundup
Tool / Process	AES-128 CTR file encryption⁴	Lynx ransomware
Tool / Process	Claims require local validation before treating FortiBleed exposure as Lynx compromise	Retained source
Tool / Process	Curve25519 Donna key agreement⁴	Lynx ransomware
Tool / Process	Desktop wallpaper replacement with ransom-note messaging⁶	Threat group profile
Tool / Process	Double-extortion pressure with data-theft claims⁶	Threat group profile
Tool / Process	Fast, medium, slow, and full-file encryption modes⁶	Threat group profile
Tool / Process	FortiBleed-derived access-to-ransomware deployment context	Retained source
Tool / Process	FortiGate credential-harvesting campaign linkage	Retained source
Tool / Process	FortiGuard detections: W32/IncRansom.A!tr.ransom, W32/Filecoder_IncRansom.A!tr, W32/Filecoder_IncRansom.A!tr.ransom⁵	Ransomware Roundup
Tool / Process	Hidden-drive loading / mount behavior⁵	Ransomware Roundup
Tool / Process	INC Ransom source-code lineage / rebrand assessment⁴	Lynx ransomware
Tool / Process	Initial access broker handoff context	Retained source
Tool / Process	Network-share encryption option⁵	Ransomware Roundup
Tool / Process	Printer ransom-note behavior⁵	Ransomware Roundup
Tool / Process	Process and service termination before encryption⁶	Threat group profile
Tool / Process	Ransomware-as-a-Service affiliate model⁶	Threat group profile
Tool / Process	Restart Manager API abuse to handle locked files⁵	Ransomware Roundup
Tool / Process	Runtime arguments for targeted file or directory encryption⁵	Ransomware Roundup
Tool / Process	Shadow-copy deletion⁵	Ransomware Roundup
Tool / Process	Windows ransomware samples publicly analyzed⁶	Threat group profile
ATT&CK ID	T1005 - Data from Local System⁵	Ransomware Roundup
ATT&CK ID	T1039 - Data from Network Shared Drive⁵	Ransomware Roundup
ATT&CK ID	T1059 - Command and Scripting Interpreter / operator execution context⁵	Ransomware Roundup
ATT&CK ID	T1078 - Valid Accounts / FortiGate credential-access context	Retained source
ATT&CK ID	T1083 - File and Directory Discovery⁵	Ransomware Roundup
ATT&CK ID	T1105 - Ingress Tool Transfer / affiliate intrusion context⁵	Ransomware Roundup
ATT&CK ID	T1135 - Network Share Discovery⁵	Ransomware Roundup
ATT&CK ID	T1190 - Exploit Public-Facing Application / edge-access context	Retained source
ATT&CK ID	T1486 - Data Encrypted for Impact⁵	Ransomware Roundup
ATT&CK ID	T1489 - Service Stop⁵	Ransomware Roundup
ATT&CK ID	T1490 - Inhibit System Recovery⁵	Ransomware Roundup
ATT&CK ID	T1566 - Phishing / common delivery hypothesis⁵	Ransomware Roundup
ATT&CK ID	T1567 - Exfiltration Over Web Service⁵	Ransomware Roundup
ATT&CK ID	T1657 - Financial Theft / extortion pressure context⁵	Ransomware Roundup
Alias / Related Name	FortiBleed-linked ransomware operation	Retained source
Alias / Related Name	INC / Lynx²	SOCRadar
Alias / Related Name	INC Ransom lineage²	SOCRadar
Alias / Related Name	Lynx²	SOCRadar
Alias / Related Name	Lynx ransomware²	SOCRadar
Alias / Related Name	Tarnished Scorpius lineage context⁴	Lynx ransomware
Malware Family	INC Ransom lineage / predecessor context⁵	Ransomware Roundup
Malware Family	Lynx ransomware⁴	Lynx ransomware

Show remaining 34 observables

Campaign Context	January 2025: Fortinet reported 96 data-leak-site victim entries and geographic/sector concentration caveats; IntelliOS does not republish raw victim lists.⁵	Ransomware Roundup
Campaign Context	July 2024: WatchGuard, Fortinet, Unit 42, and Halcyon place Lynx emergence/first-seen activity in July 2024.³	WatchGuard ransomware tracker
Campaign Context	July 2026: SOCRadar linked FortiBleed credential-harvesting infrastructure to INC Ransom and Lynx ransomware operations.	Retained source
CLASSIFICATION	SOCRadar and WatchGuard retain Lynx as an active crypto-ransomware/data-broker/RaaS actor with July 2024 first-seen context.³	WatchGuard ransomware tracker
COUNTRY	Australia³	WatchGuard ransomware tracker
COUNTRY	Canada³	WatchGuard ransomware tracker
COUNTRY	Guatemala³	WatchGuard ransomware tracker
COUNTRY	United Kingdom³	WatchGuard ransomware tracker
COUNTRY	United States³	WatchGuard ransomware tracker
OBSERVABLE	Cybersecurity Dive independently summarized SOCRadar's FortiBleed-to-INC/Lynx reporting and retained caveats that some Nextcloud exploitation questions remained under investigation.⁹	FortiBleed campaign traced to INC and Lynx ransomware operations
OBSERVABLE	Fortinet retained public SHA-256 file hashes for Lynx ransomware samples; IntelliOS retains hashes but excludes raw contact channels, onion URLs, victim rows, negotiation details, and payment instructions.⁵	Ransomware Roundup
OBSERVABLE	Picus and Halcyon describe Lynx as a RaaS actor tied to INC Ransom source-code lineage and double-extortion operations; IntelliOS uses those as enrichment context.⁷	Lynx ransomware
OBSERVABLE	SOCRadar says FortiBleed infrastructure linked to INC and Lynx included an operator observed in both negotiation panels and at least 12 ransomware deployments from FortiBleed-derived access.	Retained source
OBSERVABLE	The Hacker News summarized SOCRadar's FortiBleed findings, including FortiGate scanning, admin-level access, completed attack-chain counts, and ransomware deployments; IntelliOS treats this as corroborating coverage, not a separate primary attribution source.¹⁰	FortiBleed credential theft linked to INC and Lynx ransomware
OBSERVABLE	Unit 42 reported 70.8% matched functions between analyzed INC and Lynx samples, supporting source-code lineage but not proving every INC operator is Lynx.⁴	Lynx ransomware
REGION	Global exposure³	WatchGuard ransomware tracker
SECTOR	Aerospace³	WatchGuard ransomware tracker
SECTOR	Agriculture³	WatchGuard ransomware tracker
SECTOR	Automotive³	WatchGuard ransomware tracker
SECTOR	Construction³	WatchGuard ransomware tracker
SECTOR	Engineering services³	WatchGuard ransomware tracker
SECTOR	Environmental services³	WatchGuard ransomware tracker
SECTOR	Finance³	WatchGuard ransomware tracker
SECTOR	Healthcare³	WatchGuard ransomware tracker
SECTOR	Hospitality³	WatchGuard ransomware tracker
SECTOR	Manufacturing³	WatchGuard ransomware tracker
SECTOR	Mining³	WatchGuard ransomware tracker
SECTOR	Oil and gas³	WatchGuard ransomware tracker
SECTOR	Organizations with exposed or compromised Fortinet edge credentials	Retained source
SECTOR	Real estate³	WatchGuard ransomware tracker
SECTOR	Retail³	WatchGuard ransomware tracker
SECTOR	Technology³	WatchGuard ransomware tracker
SOURCE_BOUNDARY	Recorded Future/Insikt treats FortiBleed seller credibility as mixed and does not independently validate every downstream actor claim; IntelliOS keeps FortiBleed-to-Lynx claims source-caveated.⁸	FortiBleed campaign exposes credentials for FortiGate systems
SOURCE_BOUNDARY	Unit 42 and Fortinet assess Lynx as sharing significant code and behavior overlap with INC Ransom; IntelliOS records lineage/context rather than automatically merging Lynx and INC into one actor card.⁴	Lynx ransomware

Source	Reported	Retained	Coverage Status
SOCRadar²	767	4	Reported IOC count and SOCRadar-backed observable rows retained in IntelliOS.
SOCRadar¹	N/A	0	Context source retained; no direct observable rows retained from this source yet.
SOCRadar²	N/A	4	Public observables or source-context rows retained and displayed.
WatchGuard³	N/A	23	Public observables or source-context rows retained and displayed.
Palo Alto Networks Unit 42⁴	N/A	7	Public observables or source-context rows retained and displayed.
Fortinet FortiGuard Labs⁵	N/A	40	Public observables or source-context rows retained and displayed.
Halcyon⁶	N/A	6	Public observables or source-context rows retained and displayed.
Picus Security⁷	N/A	1	Public observables or source-context rows retained and displayed.
SOCRadar STRU	N/A	10	Public observables or source-context rows retained and displayed.
Recorded Future Insikt Group⁸	N/A	1	Public observables or source-context rows retained and displayed.
Cybersecurity Dive⁹	N/A	1	Public observables or source-context rows retained and displayed.
The Hacker News¹⁰	N/A	1	Public observables or source-context rows retained and displayed.

IntelliOS Intel Products

Linked Products

None Found

Source Integrity AppendixSource reconciliation, citations, and collision-boundary analysisOpen

Source Reconciliation

How IntelliOS Keeps The Labels Straight

Source	Primary Name	Treatment	Boundary
SOCRadar	Lynx	Baseline actor-card record retained for the current profile view.	Fields reflect the retained database record. Additional source consensus, collisions, and canonical identity mappings can be layered into this profile without automatically merging actors.
IntelliOS	Lynx	Normalizes this record for directory search, card display, profile lookup, and future product linking.	Normalization is a presentation and workflow aid; it is not an independent attribution claim.

Open retained source profile

Citations

Source Notes

#	Source	Use In Card
1	SOCRadar Threat Actor Database https://socradar.io/free-tools/threat-actor/ransomware	Baseline actor-card corpus source for retained profile fields.
2	SOCRadar Actor Profile https://socradar.io/free-tools/ransomware-intelligence/groups/lynx	Per-actor SOCRadar profile source for ransomware profile metadata and IOC count when available.
3	WatchGuard ransomware tracker: Lynx https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/lynx	Ransomware Tracker
4	Lynx ransomware: a rebranding of INC ransomware https://unit42.paloaltonetworks.com/inc-ransomware-rebrand-to-lynx/	Malware Analysis
5	Ransomware Roundup: Lynx https://www.fortinet.com/blog/threat-research/ransomware-roundup-lynx	Malware Analysis / IOCs
6	Threat group profile: Lynx https://www.halcyon.ai/threat-group/lynx	Threat Actor Profile
7	Lynx ransomware: exposing how INC ransomware rebrands itself https://www.picussecurity.com/resource/blog/lynx-ransomware	Ransomware Analysis
8	FortiBleed campaign exposes credentials for FortiGate systems https://www.recordedfuture.com/blog/critical-fortibleed-campaign	Campaign Deconfliction
9	FortiBleed campaign traced to INC and Lynx ransomware operations https://www.cybersecuritydive.com/news/fortibleed-campaign-traced-to-inc-and-lynx-ransomware-operations/824348/	News / Attribution Coverage
10	FortiBleed credential theft linked to INC and Lynx ransomware https://thehackernews.com/2026/07/fortibleed-credential-theft-linked-to.html	News / Attribution Coverage
11	FortiBleed campaign linked to INC and Lynx ransomware operations https://socradar.io/blog/fortibleed-inc-lynx-ransomware-link/	SOCRadar campaign row source for FortiBleed Credential Exposure Campaign.
12	lynx - Ransomware.live group profile https://www.ransomware.live/group/lynx	Ransomware.live campaign row source for lynx Ransomware / Extortion Operations.

Source Collision Notes

Open Interpretation Boundaries

IntelliOS starts this detail page from the retained source record for Lynx.

No possible same-actor, alias reuse, sub-cluster, duplicate-boundary, or external-source collision is currently retained for this actor.

Collision Source	Candidate Records	Shared Evidence	Treatment
None retained	No candidate records	No shared evidence recorded	No collision action needed.
External sources	Mandiant, CrowdStrike, other non-SOCRadar sources	None retained	External collisions are shown separately when retained.

Loading Threat Actor Cards