Ransomware.live: lynx

| Active | RaaS

Lynx is a ransomware-as-a-service operation that emerged in mid-2024 as a rebrand of INC Ransomware (whose source code was sold for $300,000 on the RAMP forum), claiming ~300 victims across manufacturing, business services, technology, and transportation with an 80/20 profit split for affiliates.

Victims

410

First Discovered

2024-07-29

victim

Last Discovered

2026-05-10

victim

Inactive Since

days

Avg Delay

27.5

days

Infostealer

19.0%

victims with domain

Countries

hit

View Victims on World Map View Group Statistics

Attack Velocity — Last 12 months

+100% vs last month

Known Locations (10)

Title	Available	Last Visit	Server Info	FQDN
Lynx	No	2026-04-28T07:24:29		`lynxblog.net`
Lynx	No	2026-04-28T07:27:01		`lynxch2k5xi35j7hlbmwl7d6u2oz4vp2wqp6qkwol624cod3d6iqiyqd.onion`
Lynx	Yes	2026-05-14T09:36:28	nginx 1.27.5	`lynxchatly4zludmhmi75jrwhycnoqvkxb4prohxmyzf4euf5gjxroad.onion`
Lynx	No	2026-04-28T07:29:33	nginx 1.27.5	`lynxblogxstgzsarfyk2pvhdv45igghb4zmthnzmsipzeoduruz3xwqd.onion`
Lynx	Yes	2026-05-14T09:09:28	nginx 1.27.5	`lynxblogxutufossaeawlij3j3uikaloll5ko6grzhkwdclrjngrfoid.onion`
Lynx	Yes	2026-05-14T09:10:40	nginx 1.27.5	`lynxblogoxllth4b46cfwlop5pfj4s7dyv37yuy7qn2ftan6gd72hsad.onion`
Lynx	Yes	2026-05-14T09:08:51	nginx 1.27.5	`lynxblogmx3rbiwg3rpj4nds25hjsnrwkpxt5gaznetfikz4gz2csyad.onion`
Lynx	Yes	2026-05-14T09:37:03	nginx 1.27.5	`lynxblogco7r37jt7p5wrmfxzqze7ghxw6rihzkqc455qluacwotciyd.onion`
Lynx	No	2026-05-14T09:39:02		`lynxblogijy4jfoblgix2klxmkbgee4leoeuge7qt4fpfkj4zbi2sjyd.onion`
Lynx	Yes	2026-05-14T09:10:02	nginx 1.27.5	`lynxblogtwatfsrwj3oatpejwxk5bngqcd5f7s26iskagfu7ouaomjad.onion`

Target

Heatmap

Ransom Notes (2)

Tools Used

This information is provided by Ransomware-Tool-Matrix
Discovery	RMM Tools	Defense Evasion	Credential Theft	OffSec	Networking	LOLBAS	Exfiltration
SoftPerfect NetScan	placeholder	placeholder	placeholder	placeholder	placeholder	placeholder	Restic

TTPs Matrix (9)

This information is provided by Crocodyli & Ransomware.live
Initial Access	Execution	Defense Evasion	Credential Access	Discovery	Lateral Movement	Exfiltration	Command and Control	Impact
Valid Accounts	Command and Scripting Interpreter: PowerShell	Masquerading	OS Credential Dumping: LSASS Memory	Query Registry	Remote Services: Remote Desktop Protocol	Exfiltration Over Web Service: Exfiltration to Cloud Storage	Application Layer Protocol: Web Protocols	Data Encrypted for Impact
Phishing: Spearphishing Attachment		Disable or Modify Tools		System Information Discovery				Inhibit System Recovery

YARA Rules (1)

Indicators of Compromise (IoCs) (20)

Email 1 Hash MD5 19

Type	IOC
`Email`	`martina.lestariid1898@proton.me`
`Hash MD5`	`0e521e0452f113cdf8b5c2fa6580db1f`
`Hash MD5`	`146d350fd6271b4411714c630d8cda87`
`Hash MD5`	`14a0ecf45aa72adb2b1f2ccca99f6faa`
`Hash MD5`	`2348b069647af0a714ae1e005f73b522`
`Hash MD5`	`30656c737338818bee8cc3591e3f3dcc`
`Hash MD5`	`31a77e0d1c1b91eebec1f7cdcc1ab8b8`
`Hash MD5`	`3a39bcd9fc840b4e13042f916d9eb39a`
`Hash MD5`	`571684f28ce1cf4d8236dbd46ef6f7f0`
`Hash MD5`	`57f45c0738af9cd49c61984ea99f83ca`
`Hash MD5`	`65c0c7c9fe6bc1d5296447aae6c6c14c`
`Hash MD5`	`67a44a38cc36becd6e2e9c20c27fd9ad`
`Hash MD5`	`74ae58a716aa834949388ee1574788e0`
`Hash MD5`	`7e851829ee37bc0cf65a268d1d1baa7a`
`Hash MD5`	`a20886a5b378624d16972db66bd4e7e1`
`Hash MD5`	`b1d81e8bbecccc547645d17395538a2d`
`Hash MD5`	`b47cdcdc179c5949ce18f4d161603901`
`Hash MD5`	`d972bbbb3edb0e5ab5751b911f3dda17`
`Hash MD5`	`f16238836909d07f86154c5ccbade96a`
`Hash MD5`	`ff458208c49836cdec92f0a4a7ba6afd`