lynx
ransomware group · aka Lynx, Lynx ransomware · unknown · active since 2024-07 (mid-2024; first public vendor reporting by Sekoia and Kroll)
Victims · 7d
0flat
Victims · 30d
1active targets
Victims · 90d
3
All-time (tracked)
418since 2024-08-02
Last post
08-29 02:30UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
Lynx is a double-extortion ransomware operation first publicly reported in mid-2024, which researchers (Sekoia, 2024) assess as a likely rebrand or successor of Babuk/BabLock based on code similarities. It operates an affiliate-based RaaS model and ships encryptors for Windows, Linux, and VMware ESXi environments (vendor reporting, 2024-2025). Kroll (2025) describes big-game hunting of mid-sized organizations with initial access typically via compromised credentials or remote-access services, reconnaissance using network scanners, credential theft from Chromium-based browsers, and fast partial encryption using ChaCha20/AES. No public law-enforcement takedown is reported and no vendor or blockchain-analytics earnings estimate is available. The dashboard's tracked leak-site activity shows low recent volume (0 victims in 7 days, 6 in 90 days, last post 2026-08-29).
Tactics & tooling
- Double extortion: steals data before encryption and pressures non-payers via leak-site listings
- Ransomware-as-a-service model using affiliates (vendor reporting, 2024-2025)
- Encryptor variants for Windows, Linux, and VMware ESXi (Sekoia/Kroll, 2024-2025)
- Fast partial encryption of large files using ChaCha20/AES (Kroll, 2025)
- Network reconnaissance with tools such as SoftPerfect Network Scanner (Kroll, 2025)
- Credential harvesting from Chromium-based browser data (Kroll, 2025)
- PowerShell and living-off-the-land activity to disable Defender and delete shadow copies/backups (Kroll, 2025)
- Initial access via compromised credentials or remote-access services; no specific CVEs publicly attributed (unknown)
Targeted sectors
manufacturingprofessional serviceshealthcareconstructioneducationgovernmentfinance
Notable public victims
Kurita (kurita.eu), Wolf Construction (wolfconstruction.net), Jackson County, Indiana (jacksoncountyin.com), Easterseals Iowa (eastersealsia.org)
Estimated earnings
No public figure.
Leak-site victims418 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| SCM GROUP | · Nov 26, 2024 | SCM Group, based in Rimini, Italy, is a company that specializes in manufacturin... |
| Everything Breaks | · Nov 25, 2024 | With 20 years of experience working in the warranty business, the head honchos a... |
| Keable & Brown | · Nov 25, 2024 | Commercial and Residential Real Estate Law, Business and Construction Law, Proba... |
| TOC | · Nov 25, 2024 | TOC Logistics information Since 2012, we have been growing our business into ... |
| BeClever | · Nov 25, 2024 | https://beclevercorp.com/ Ser líderes globales en soluciones financieras modula... |
| Extra | · Nov 25, 2024 | https://www.extrashop.be/ We have 400gb data of this company |
| Hypertype | · Nov 24, 2024 | Hypertype Inc. has been providing quality transcription service to Emergency Dep... |
| Suneva Medical | · Nov 22, 2024 | Suneva Medical, based in San Diego, specializes in regenerative aesthetic produc... |
| Suneva Medical(sunevamedical.com) | · Nov 21, 2024 | Suneva Medical, based in San Diego, specializes in regenerative aesthetic produc... |
| Grupo Trisan | · Nov 17, 2024 | El Grupo Trisan ofrece soluciones innovadoras para los sectores agro, pecuario, ... |
| Grupo_Trisan | · Nov 16, 2024 | El Grupo Trisan ofrece soluciones innovadoras para los sectores agro, pecuario, ... |
| Mark Thomas | · Nov 14, 2024 | Founded in 1927, Mark Thomas & Company have provided land surveying, engineering... |
| Banco de Fomento Internacional | · Nov 12, 2024 | Finance Organization. we have 220gb of data in our hand |
| TaxPros of Clermont | · Nov 12, 2024 | For over 25 years, Tax Preparation/Consulting firm owned by CPA's and Attorney's... |
| DSZ | · Nov 11, 2024 | DZS is a global leader of Network Edge, Connected Home/Enterprise and AI Cloud S... |
| Future Metals | · Nov 11, 2024 | The Future Metals Company Future Metals is a Marmon Group / Berkshire Hathaway ... |
| Plowman Craven | · Nov 11, 2024 | Integrated measurement and consultancy services to the property and infrastructu... |
| Siltech (siltechcorp.local) | · Nov 9, 2024 | Siltech has two modern plants, one located in Toronto, Canada and the other in M... |
| WimCoCorp | · Nov 9, 2024 | The Rawls family of Washington, North Carolina has owned and operated WIMCO (ori... |
| NEBRASKALAND | · Nov 9, 2024 | Nebraskaland, Inc. distributes and sells seafood and meat products to customers ... |
| dzsi.com | · Nov 7, 2024 | DZS is a global leader of Network Edge, Connected Home/Enterprise and AI Cloud S... |
| futuremetals.com | · Nov 7, 2024 | The Future Metals Company Future Metals is a Marmon Group / Berkshire Hathaway ... |
| plowmancraven.co.uk | · Nov 7, 2024 | Integrated measurement and consultancy services to the property and infrastructu... |
| Interoute agency | · Nov 6, 2024 | Bienvenue chez INTEROUTE, société de transport et logistique basée à Foetz au G... |
| LmayInteroute agency | · Nov 6, 2024 | Bienvenue chez INTEROUTE, société de transport et logistique basée à Foetz au G... |
| Model Die & Mold | · Nov 5, 2024 | Model Die & Mold, Inc. Designs and Manufactures Injection and Compression molds.... |
| Triverus | · Oct 28, 2024 | Triverus vehicles use high-efficiency cleaning and recovery technology, and are ... |
| ValueMax Group | · Oct 25, 2024 | PROOFS (CLIENTS ID CARDS) |
| Precision Electrical Systems | · Oct 25, 2024 | PROOFS(DOCUMENTS, DL) |
| Denkali | · Oct 25, 2024 | PROOFS (PROJECTS, DOCUMENTS) |
| LifeMine | · Oct 24, 2024 | Developer of a drug discovery platform designed to elucidate human biology and c... |
| lifeminetx.com | · Oct 24, 2024 | Developer of a drug discovery platform designed to elucidate human biology and c... |
| Tricon Energy | · Oct 23, 2024 | TRICON is an international trader and marketer for main petrochemicals, essentia... |
| Funlab | · Oct 16, 2024 | Funlab is the world's premiere creator of competitive socialising experiences ... |
| Tankstar | · Oct 16, 2024 | Logistic company https://www.tankstar.com/ We have huge amount of data in our ha... |
| FUN-LAB | · Oct 14, 2024 | Funlab is the world's premiere creator of competitive socialising experiences ... |
| tankstar.com | · Oct 9, 2024 | Logistic company https://www.tankstar.com/ We have huge amount of data in our ha... |
| Sit & Sleep | · Oct 8, 2024 | Founded in 1978 and headquartered in Gardena, California, Sit 'n Sleep is a matt... |
| Blain Supply | · Oct 8, 2024 | Blain Supply, Inc. operates as a specialty discount retailer in the United State... |
| English Construction Company | · Sep 26, 2024 | Founded in 1909 and headquartered in Lynchburg, Virginia, English Construction C... |
| triverus.com | · Sep 25, 2024 | Triverus vehicles use high-efficiency cleaning and recovery technology, and are ... |
| Cruz Marine (cruz.local) | · Sep 16, 2024 | Cruz Marine transports employees, equipment, fuel and materials to remote sites ... |
| Ascend Analytics (ascendanalytics.com) | · Sep 13, 2024 | Founded in 2002, Ascend Analytics is an innovative software service company focu... |
| Arbitech (arb.local) | · Sep 6, 2024 | Arbitech, LLC, founded in August 2000, is the nation's leading independent IT di... |
| idom.com | · Sep 4, 2024 | Desde la misma fundación de IDOM por Rafael Escolá en 1957, se estableció que la... |
| Tranter (tcn.local) | · Aug 31, 2024 | Tranter is a global engineering and manufacturing group specializing in thermal ... |
| Riverside Resort Hotel and Casino | · Aug 30, 2024 | Riverside Resort Hotel and Casino, founded in 1966 and headquartered in Laughlin... |
| Gortemoller Engineering (gorteng.local) | · Aug 29, 2024 | Gortemoller Engineering, Inc. has been providing civil engineering and land deve... |
| tcn.local | · Aug 28, 2024 | Tranter is a global engineering and manufacturing group specializing in thermal ... |
| KidKraft | · Aug 27, 2024 | We aim to inspire imaginative play for children everywhere. For over 50 years, ... |
In the newsAll →
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .