Lynx Ransomware is a ransomware-as-a-service (RaaS) operation first identified in 2024 that employs a double-extortion strategy to pressure victims into paying ransoms. The group encrypts systems while also stealing sensitive data and threatening to publish it on a dedicated leak site if demands are not met. Lynx operates through an affiliate model, offering partners an 80/20 revenue-sharing arrangement and optional call center services to increase pressure during negotiations. This threat profile examines the group’s operations, targeted industries and regions, known exploited vulnerabilities, associated threat actors, and tools used throughout the attack lifecycle. It also analyzes observed behaviors in Windows environments, outlines the ransomware kill chain, and maps tactics and techni

Join for free to read