Lynx Ransomware: A Rebranding of INC Ransomware
Summary: Palo Alto Networks researchers identified Lynx ransomware in July 2024 as a successor to INC ransomware, sharing 48% of matched functions overall and 70.8% of functions common to both families, based on BinDiff comparison of samples. Lynx runs as a ransomware-as-a-service operation targeting retail, real estate, architecture, and financial and environmental services in the U.S. and UK, using AES-128 in CTR mode and Curve25519 Donna encryption, appending the .lynx extension and exfiltrating data before encryption for double extortion.
What you should know: INC's source code was for sale on the criminal underground market as early as March 2024, so the 70.8% shared-function overlap between INC and Lynx is a template other malware authors can buy and repackage - meaning your detection coverage for one family may not track the next rebrand.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026