Threat Actors Use Compromised RDP to Deploy Lynx Ransomware After Deleting Backups

Gbhackers •Mayura Kathir • November 18, 2025

GBHackers on Security is a top cybersecurity news platform, delivering up-to-date coverage on breaches, emerging threats, malware, vulnerabilities, and global cyber incidents.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Lynx Ransomware Deployed via Compromised RDP After Backup Deletion Threat actors are exploiting compromised Remote Desktop Protocol (RDP) logins to deploy Lynx ransomware. The attackers are deleting server backups to maximize the impact of the ransomware, affecting organizations that rely on these backups for recovery. This tactic highlights the increasing sophistication of ransomware attacks in the cybersecurity landscape. 5 sources 37

Extracted Entities

Threat Actors Use Compromised RDP to Deploy Lynx Ransomware After Deleting Backups

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Ransomware Groups (1)