UnclassifiedUnknown
Cosmic Lynx
Cosmic Lynx is a threat actor group, tracked by Brandefense. It targets the Manufacturing sector in 36 countries, including the United States and India. It uses 5 MITRE ATT&CK techniques.
- Techniques
- 5
- Exploited CVEs
- No CVE data
- First seen
- Jul 1, 2019
- Record updated
Who They Target.
Sectors · 1
Countries · 36
How They Operate · MITRE ATT&CK.
5 techniques across 4 of 14 tacticsReconnaissance2
T1583.001
Acquire Infrastructure: Domains
Acquire Infrastructure: Domains
T1591.004
Gather Victim Org Information: Identify Roles
Gather Victim Org Information: Identify Roles
Resource Development1
T1583.003
Acquire Infrastructure: Virtual Private Server
Acquire Infrastructure: Virtual Private Server
Initial Access1
T1566
Phishing
Phishing
Execution·
Persistence·
Privilege Escalation·
Defense Evasion1
T1656
Impersonation
Impersonation
Credential Access·
Discovery·
Lateral Movement·
Collection·
Command and Control·
Exfiltration·
Impact·
Campaigns.
- Cosmic Lynx BEC OperationsJul 2020
Indicators Of Compromise.
TLP:CLEAR131 indicators on the Brandefense platform
IP, domain and hash indicators · YARA rules · ATT&CK Navigator export
Request A DemoAbout Cosmic Lynx.
Cosmic Lynx is a Russia-based BEC cybercriminal organization that has significantly impacted the email threat landscape with sophisticated, high-dollar phishing attacks.
Last updated Oct 19, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.