Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Lynx – Restic Utility Used for Staged Backup-Style Exfiltration

Lynx Exfiltration Sentinel
MITRE ATT&CK
Exfiltration to Cloud Storage
Data Source
DeviceProcessEvents
Date Added
2026-07-23
Last Updated
2026-07-23
Source
ransomware.live group_tools dataset (lynx)
What This Detects
Lynx uses the legitimate backup tool Restic, pointed at cloud/S3-compatible remotes, to exfiltrate data under the guise of routine backup traffic before deploying its encryptor.
Query
DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName =~ "restic.exe"
| where ProcessCommandLine has_any ("backup","s3:","rest:","b2:")
| project Timestamp, DeviceName, ProcessCommandLine, AccountName, FolderPath

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.