lynx

Lynx is a ransomware group that operates an extortion-based model, encrypting data and using threats of public release, with notable tradecraft including deployment via compromised RDP logins and deleting backups to hinder recovery. Victims attributed to Lynx total around 400, with the most affected sectors including Manufacturing, Business Services, Technology, Transportation/Logistics, and Construction, and the geographic focus in the United States, United Kingdom, Canada, Germany, and Australia. A recognizable pattern across recent reporting is repeated use of compromised RDP access to deploy the ransomware and the deletion of backups to maximize impact. For example, the 2025-11-18 report documents Lynx deploying via compromised RDP and deleting backups as part of its operations.

Sectors: Manufacturing, Business Services, Technology · Countries: US, GB, CA