Threat Actors Leveraging compromised RDP Logins to Deploy Lynx Ransomware After ...

Cybersecuritynews • November 18, 2025

Security researchers continue to monitor this evolving threat as attackers refine their techniques and expand their targeting scope across various ...

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Lynx Ransomware Deployed via Compromised RDP After Backup Deletion Threat actors are exploiting compromised Remote Desktop Protocol (RDP) logins to deploy Lynx ransomware. The attackers are deleting server backups to maximize the impact of the ransomware, affecting organizations that rely on these backups for recovery. This tactic highlights the increasing sophistication of ransomware attacks in the cybersecurity landscape. 5 sources 37

Threat Actors Leveraging compromised RDP Logins to Deploy Lynx Ransomware After ...

The full story

Extracted Entities

Attack Types (1)

Ransomware Groups (1)