New Name, Same Threat: How Lynx Ransomware Exploits Trusted Access

Written by Nick Thanos | Jul 31, 2026, 2:04:57 AM

Prepared by: Nick Thanos | Published: 31 July 2026

Threat actor profile: Lynx

Threat actor status: ACTIVE

Since mid-2024, a ransomware group called Lynx has been targeting organisations across manufacturing, legal, energy, construction, healthcare, telecommunications and finance by exfiltrating sensitive data and encrypting victim systems. Active globally and observed directly by Triskele Labs across two incident response engagements in Australia, the group is widely believed to be a rebrand or continuation of INC Ransom, operating under the same ransomware-as-a-service (RaaS) model and pursuing the same double extortion approach against enterprise Windows and Linux environments, including VMware ESXi systems.

Lynx: Background

Lynx first emerged in mid-2024 and is widely believed to be a rebrand or continuation of INC Ransomware. Under its ransomware-as-a-service model, affiliates carry out intrusions using infrastructure and tooling provided by the core operation, encrypting victim systems while exfiltrating sensitive data to pressure payment through dedicated leak sites hosted on both the clearnet and the dark web.

The group has been especially active across the United States, Europe, the United Kingdom and Australia. As of early 2025, over 90 organisations had been impacted, with several high-profile breaches involving multi-million-dollar ransom demands. Despite a temporary slowdown in public activity in early 2025, Lynx remains active and continues to pose a significant threat. Its ties to the former INC Ransom operation, and its demonstrated ability to adapt and rebrand, suggest it is likely to remain a notable actor in the ransomware landscape.

How Lynx Operates

Across the two incidents investigated by Triskele Labs, a consistent, methodical pattern of compromise emerged.

Initial Access: LDAP VPN Misconfiguration Abuse

Lynx affiliates exploit SSL VPNs configured with permissive LDAP settings, the protocol many organisations use to connect their VPN to Active Directory for authentication. Where this is misconfigured, any domain user can authenticate remotely using standard credentials, often bypassing least-privilege controls entirely.

This is consistent with the broader Australian landscape. Exposed SSL VPN services without MFA were the single largest initial access vector across all Triskele Labs ransomware engagements in FY25, accounting for 23 incidents, up 64% from the previous year.

Initial Access: RMM Access Without MFA

Lynx also gains footholds through Remote Monitoring and Management (RMM) platforms, legitimate software used by IT teams and managed service providers to remotely administer systems, where client accounts lacked multi-factor authentication. Without MFA, a stolen or guessed password is sufficient to hand affiliates persistent, administrative-level access.

Collection and Exfiltration: RMM Tool Abuse

Once inside, Lynx affiliates actively leverage the same RMM tools used to gain access, monitoring the victim environment, maintaining long-term presence, and exfiltrating sensitive data ahead of encryption. This reliance on tools already trusted within the environment makes early detection harder for defenders relying on signature-based tooling alone.

Encryption and Impact

Once exfiltration is complete, the ransomware binary is activated across the environment. Files are encrypted and appended with a .lynx extension, rendering data inaccessible to users.

Lynx: Reducing your exposure

The consistent entry points observed across Lynx engagements mean there are clear, actionable controls that reduce risk materially.

Enforce MFA across all external-facing services without exception.
Lynx's most common entry points, exposed VPNs and RMM platforms, both lacked MFA in the incidents Triskele Labs responded to. This single control would have closed off initial access in both cases.
Review VPN and LDAP configurations.
Permissive LDAP settings that allow any domain account to authenticate remotely undermine least-privilege access entirely. Restrict VPN authentication to only the accounts and groups that genuinely need it.
Monitor for anomalous use of legitimate remote access tools.
Because Lynx relies on RMM software already present in many environments, detection needs to focus on unusual usage patterns, not just known-bad signatures.
Maintain immutable, offline backups.
Given the double extortion model, backups protect against the encryption impact but do not prevent data exfiltration, so they are one part of a layered response, not the whole answer.
Ensure security alerting is monitored around the clock.
Whether through an internal security operations capability or an external managed detection and response (MDR) provider, continuous monitoring closes the gap between initial access and full encryption.

Summary

Lynx is an active, financially motivated ransomware group operating under a ransomware-as-a-service model since mid-2024, widely believed to be a rebrand of INC Ransom. Triskele Labs has responded directly to two Lynx incidents, giving firsthand insight into the group's behaviour. The pattern is consistent: gain initial access through a misconfigured VPN or an unprotected RMM platform, use that same RMM access to monitor and exfiltrate data, then deploy ransomware across the environment.

The defences most likely to disrupt a Lynx intrusion are foundational: enforce MFA on every external-facing service, tighten VPN and LDAP configuration, and monitor for anomalous use of legitimate remote access tools. Lynx is not a technically exceptional group. It succeeds because the environments it targets have not applied the controls that would stop it at the door.

If your organisation has experienced a Lynx incident or suspects a compromise involving ransomware or data exfiltration, engage your cyber insurer and a reputable DFIR firm promptly.

MITRE ATT&CK Mapping

TACTIC	TECHNIQUE	DESCRIPTION
Initial Access	T1078.002 - Valid Accounts: Domain Accounts	Obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defence Evasion.
Initial Access	T1078.004 - Valid Accounts: Cloud Accounts	Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defence Evasion.
Initial Access	T1133 - External Remote Services	Leverage external-facing remote services to initially access and/or persist within a network.
Initial Access	T1199 - Trusted Relationship	Gaining initial access through a trusted third-party relationship.
Execution	T1072 - Software Deployment Tools	Gain access to and use centralised software suites installed within an enterprise to execute commands and move laterally through the network.
Execution	T1059.001 - Command and Scripting Interpreter: PowerShell	Abuse PowerShell commands and scripts for execution.
Execution	T1569.002 - System Services: Service Execution	Abuse the Windows service control manager to execute malicious commands or payloads.
Persistence	T1053.005 - Scheduled Task/Job: Scheduled Task	Use Windows Task Scheduler to execute programs at system startup or on a scheduled basis for persistence.
Persistence	T1136.001 - Create Account: Local Account	Create a local account to maintain access to victim systems.
Persistence	T1543.003 - Create or Modify System Process: Windows Service	Create or modify Windows services to repeatedly execute malicious payloads as part of persistence.
Privilege Escalation	T1078.002 - Valid Accounts: Domain Accounts	Obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defence Evasion.
Defence Evasion	T1070.001 - Indicator Removal: Clear Windows Event Logs	Clear Windows Event Logs to hide the activity of an intrusion.
Defence Evasion	T1070.004 - Indicator Removal: File Deletion	Delete files left behind by the actions of their intrusion activity.
Defence Evasion	T1562.001 - Impair Defences: Disable or Modify Tools	Modify and/or disable security tools to avoid possible detection of their malware and activities.
Credential Access	T1003.001 - OS Credential Dumping: LSASS Memory	Attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).
Credential Access	T1555 - Credentials from Password Stores	Search for common password storage locations to obtain user credentials.
Credential Access	T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting	Abuse a valid Kerberos ticket-granting ticket or sniff network traffic to obtain a ticket-granting service ticket vulnerable to brute force.
Discovery	T1046 - Network Service Discovery	Attempt to get a listing of services running on remote hosts and local network infrastructure devices.
Discovery	T1057 - Process Discovery	Attempt to get information about running processes on a system.
Discovery	T1087.002 - Account Discovery: Domain Account	Attempt to get a listing of domain accounts.
Discovery	T1135 - Network Share Discovery	Look for folders and drives shared on remote systems as a means of identifying sources of information to gather.
Lateral Movement	T1021.001 - Remote Services: Remote Desktop Protocol	Use valid accounts to log into a computer using the Remote Desktop Protocol.
Lateral Movement	T1072 - Software Deployment Tools	Gain access to and use centralised software suites installed within an enterprise to execute commands and move laterally through the network.
Lateral Movement	T1550.002 - Use Alternate Authentication Material: Pass the Hash	Use stolen password hashes to move laterally within an environment, bypassing normal system access controls.
Command and Control	S0154 - Cobalt Strike	Simulation software designed to execute targeted attacks and emulate the post-exploitation actions of advanced threat actors.
Command and Control	T1219 - Remote Access Software	Use legitimate remote access tools to establish an interactive command and control channel within a network.
Command and Control	T1572 - Protocol Tunnelling	Tunnel network communications within a separate protocol to avoid detection or filtering, or to enable access to otherwise unreachable systems.
Exfiltration	T1048 - Exfiltration Over Alternative Protocol	Steal data by exfiltrating it over a different protocol than that of the existing command and control channel.
Exfiltration	T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage	Exfiltrate data to a cloud storage service rather than over their primary command and control channel.
Impact	T1486 - Data Encrypted for Impact	Encrypt data on target systems to interrupt availability to system and network resources.
Impact	T1529 - System Shutdown/Reboot	Shutdown or reboot systems to interrupt access to, or aid in the destruction of, those systems.
Impact	T1531 - Account Access Removal	Interrupt availability of system and network resources by inhibiting access to accounts used by legitimate users.
Credential Access	T1003.001 - OS Credential Dumping: LSASS Memory	Attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).
Credential Access	T1003.003 - OS Credential Dumping: NTDS	Attempt to access or create a copy of the Active Directory domain database to steal credential information.
Credential Access	T1003.006 - OS Credential Dumping: DCSync	Attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's API.
Credential Access	T1078.002 - Valid Accounts: Domain Accounts	Obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defence Evasion.
Credential Access	T1110 - Brute Force	Use brute force techniques to gain access to accounts when passwords are unknown or hashes are obtained.
Credential Access	T1110.002 - Brute Force: Password Cracking	Attempt to recover usable credentials, such as plaintext passwords, when credential material such as password hashes are obtained.
Credential Access	T1555 - Credentials from Password Stores	Search for common password storage locations to obtain user credentials.
Credential Access	T1552 - Unsecured Credentials	Search compromised systems to find and obtain insecurely stored credentials.
Discovery	T1018 - Remote System Discovery	Attempt to get a listing of other systems by IP address, hostname, or other logical identifier that may be used for Lateral Movement.
Discovery	T1033 - System Owner/User Discovery	Attempt to identify the primary user, currently logged in user, or set of users that commonly use a system.
Discovery	T1046 - Network Service Discovery	Attempt to get a listing of services running on remote hosts and local network infrastructure devices.
Discovery	T1069 - Permission Groups Discovery	Attempt to discover group and permission settings.
Discovery	T1069.002 - Permission Groups Discovery: Domain Groups	Attempt to find domain-level groups and permission settings.
Discovery	T1083 - File and Directory Discovery	Enumerate files and directories or search specific locations of a host or network share for information.
Discovery	T1087 - Account Discovery	Attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment.
Discovery	T1087.002 - Account Discovery: Domain Account	Attempt to get a listing of domain accounts.
Discovery	T1135 - Network Share Discovery	Look for folders and drives shared on remote systems as a means of identifying sources of information to gather.
Discovery	T1482 - Domain Trust Discovery	Attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities.
Discovery	T1615 - Group Policy Discovery	Gather information on Group Policy settings to identify paths for privilege escalation and security measures applied within a domain.
Lateral Movement	T1021.002 - Remote Services: SMB/Windows Admin Shares	Use valid accounts to interact with a remote network share using Server Message Block (SMB).
Lateral Movement	T1550.002 - Use Alternate Authentication Material: Pass the Hash	Use stolen password hashes to move laterally within an environment, bypassing normal system access controls.
Lateral Movement	T1570 - Lateral Tool Transfer	Transfer tools or other files between systems in a compromised environment.
Collection	T1005 - Data from Local System	Search local system sources to find files of interest and sensitive data prior to exfiltration.
Collection	T1039 - Data from Network Shared Drive	Data was collected from shared network drives.
Collection	T1119 - Automated Collection	Use automated techniques for collecting internal data once established within a system or network.
Command and Control	T1090 - Proxy	Use a connection proxy to direct network traffic between systems or act as an intermediary for command-and-control communications.
Command and Control	T1105 - Ingress Tool Transfer	Transfer tools or other files from an external system into a compromised environment.
Command and Control	T1132.001 - Data Encoding: Standard Encoding	Encode data with a standard data encoding system to make command-and-control traffic harder to detect.
Command and Control	T1219 - Remote Access Software	Use legitimate remote access tools to establish an interactive command and control channel within a network.
Command and Control	T1572 - Protocol Tunnelling	Tunnel network communications within a separate protocol to avoid detection or filtering, or to enable access to otherwise unreachable systems.
Exfiltration	T1041 - Exfiltration Over C2 Channel	Steal data by exfiltrating it over an existing command and control channel.
Exfiltration	T1048 - Exfiltration Over Alternative Protocol	Steal data by exfiltrating it over a different protocol than that of the existing command and control channel.
Exfiltration	T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol	Steal data by exfiltrating it over an unencrypted network protocol other than the existing command and control channel.
Impact	T1486 - Data Encrypted for Impact	Encrypt data on target systems to interrupt availability to system and network resources.
Impact	T1490 - Inhibit System Recovery	Delete or remove built-in data and turn off services designed to aid recovery of a corrupted system.

Common Utilised Tooling

TOOL	PURPOSE
Cobalt Strike	Post-exploitation toolkit used for command and control, often abused to deploy beacons and maintain access.
Mimikatz	Credential dumping tool used to extract passwords, hashes and Kerberos tickets from Windows memory.
Pulseway	Legitimate RMM tool, often exploited by attackers for persistent remote access.
DWAgent	Free remote desktop software, sometimes misused for stealthy access.
RemCom RAT	Lightweight remote access tool that allows execution of commands on remote Windows systems, often used for lateral movement.
FortiGate	Next-generation firewall developed by Fortinet, providing advanced threat protection, VPN and network security features.
Proton VPN	Privacy-focused VPN service that encrypts internet traffic and hides user IP addresses.
Mullvad VPN	No-logs VPN service designed for anonymity, often used to obfuscate threat actor traffic.
MeshCentral	Open-source remote management tool that allows control of systems over the internet.
DWService	Cloud-based remote access platform enabling remote control and file transfer through a web interface.
RemCom	Lightweight remote command-line execution utility, like PsExec, used for lateral movement.
WinSCP	File transfer client for SFTP, SCP and FTP, often used for moving files between systems securely.
MEGAsync	Desktop sync client for the MEGA cloud storage service, used to upload and download large datasets.
CyberDuck	File transfer application supporting cloud and FTP protocols, often abused for exfiltrating data to cloud storage.
Rclone	Command-line tool for managing and syncing files across cloud storage providers, widely used for data exfiltration.