ThreatCluster

Lynx Ransomware Deployed via Compromised RDP Logins with Backup Deletion

First seen 2 Dec 2025, 18:33 UTC •CybersecuritynewsGbhackersCyberpress •85% similarity •21

Article Content

Browse articles
ThreatCluster

Threat actors are exploiting compromised Remote Desktop Protocol (RDP) logins to deploy Lynx ransomware, targeting organizations by deleting server backups to hinder recovery efforts. Security researchers are actively monitoring this evolving threat as attackers refine their techniques and expand their targeting scope.

ThreatCluster AI How this analysis works

Extracted Entities

1 / 2

Community

Browse all →

Tracked Entities in This Story

Lynx