lynx
Known ransomware group Dormant / low-volume
Lynx is a ransomware-as-a-service operation that emerged in 2024, widely assessed as a successor to or rebrand of INC Ransom based on overlapping code and infrastructure. It practices double extortion against small and mid-sized businesses across multiple sectors.
1
Total Claims
1
Critical
—
Records Claimed
1
Industries Hit
Active span: May 10, 2026 – May 10, 2026 · 1 organizations targeted
Dormant / low-volume
Actor Threat Profile
Activity Timeline
Peak: May 2026 (1)May 2026
LessMore
May 2026Share this profile
Top Targeted Industries
Healthcare 1
Tradecraft & Infrastructure
2
Documented tools
9 / 13
MITRE tactics / techniques
10
Known leak sites
DiscoveryEnumExfiltration
Full intelligence profile on ransomware.live →