Lynx
Lynx is a ransomware group with a financial motive, tracked by Brandefense. It targets 16 sectors, including Government and Technology, in 29 countries, including the United States and the United Kingdom. It uses 17 MITRE ATT&CK techniques.
Also known as
- lynx Team
- Techniques
- 17
- Exploited CVEs
- No CVE data
- First seen
- Jul 29, 2024
- Last seen
- Aug 29, 2026
- Record updated
Who They Target.
Sectors · 16
Countries · 29
Labelsbdef-qf:latestglobal
About Lynx.
Lynx is a ransomware-as-a-service operation that emerged in mid-2024 as a rebrand of INC Ransomware (whose source code was sold for $300,000 on the RAMP forum), claiming ~300 victims across manufacturing, business services, technology, and transportation with an 80/20 profit split for affiliates.
Last updated Oct 7, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.