lynx
ransomware group · aka Lynx, Lynx ransomware · unknown · active since 2024-07 (mid-2024; first public vendor reporting by Sekoia and Kroll)
Victims · 7d
0flat
Victims · 30d
1active targets
Victims · 90d
3
All-time (tracked)
418since 2024-08-02
Last post
08-29 02:30UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
Lynx is a double-extortion ransomware operation first publicly reported in mid-2024, which researchers (Sekoia, 2024) assess as a likely rebrand or successor of Babuk/BabLock based on code similarities. It operates an affiliate-based RaaS model and ships encryptors for Windows, Linux, and VMware ESXi environments (vendor reporting, 2024-2025). Kroll (2025) describes big-game hunting of mid-sized organizations with initial access typically via compromised credentials or remote-access services, reconnaissance using network scanners, credential theft from Chromium-based browsers, and fast partial encryption using ChaCha20/AES. No public law-enforcement takedown is reported and no vendor or blockchain-analytics earnings estimate is available. The dashboard's tracked leak-site activity shows low recent volume (0 victims in 7 days, 6 in 90 days, last post 2026-08-29).
Tactics & tooling
- Double extortion: steals data before encryption and pressures non-payers via leak-site listings
- Ransomware-as-a-service model using affiliates (vendor reporting, 2024-2025)
- Encryptor variants for Windows, Linux, and VMware ESXi (Sekoia/Kroll, 2024-2025)
- Fast partial encryption of large files using ChaCha20/AES (Kroll, 2025)
- Network reconnaissance with tools such as SoftPerfect Network Scanner (Kroll, 2025)
- Credential harvesting from Chromium-based browser data (Kroll, 2025)
- PowerShell and living-off-the-land activity to disable Defender and delete shadow copies/backups (Kroll, 2025)
- Initial access via compromised credentials or remote-access services; no specific CVEs publicly attributed (unknown)
Targeted sectors
manufacturingprofessional serviceshealthcareconstructioneducationgovernmentfinance
Notable public victims
Kurita (kurita.eu), Wolf Construction (wolfconstruction.net), Jackson County, Indiana (jacksoncountyin.com), Easterseals Iowa (eastersealsia.org)
Estimated earnings
No public figure.
Leak-site victims418 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| Myelec Electrical | · Aug 24, 2024 | Myelec Electrical Wholesalers is a proud to be a 100% locally owned and operated... |
| Wallace Construction Specialties (wcs.local)) | · Aug 24, 2024 | WALLACE CONSTRUCTION SPECIALTIES LTD. is a leading distributor of specialty cons... |
| Bay Sales (cog.local) | · Aug 24, 2024 | Welcome to the Bay Sales team! For over three decades, we've been dedicated to d... |
| PBS group | · Aug 24, 2024 | We design, implement and maintain systems that allow our customers to exploit te... |
| MacEwen Petroleum | · Aug 21, 2024 | Headquartered in Ontario, Canada, MacEwen Petroleum Inc. is a Canadian owned and... |
| kidkraft.com | · Aug 21, 2024 | We aim to inspire imaginative play for children everywhere. For over 50 years, ... |
| Rushlift (lks.net) | · Aug 20, 2024 | Are you a business in the UK in need of a reliable and cost-effective forklift s... |
| Innoquest | · Aug 15, 2024 | Since 1993 Innoquest president and licensed engineer Bill Hughes has designed ov... |
| Warwick Hotels and Resorts | · Aug 12, 2024 | Founded in 1980, Warwick Hotels and Resorts is a collection of upscale hotels th... |
| Alvan Blanch Development | · Aug 12, 2024 | Alvan Blanch is a British manufacturing and project engineering company. Wi... |
| Concut (ddm.local) | · Aug 9, 2024 | Founded in 1946, DDM CONCUT (f.k.a. Dixie Diamond Manufacturing and Concut) has ... |
| Miller Boskus Lack Architects (ad.mbl-arch.com) | · Aug 9, 2024 | Miller Boskus Lack Architects PA is a company that operates in the Architecture,... |
| Johnson Laschober & Associates | · Aug 9, 2024 | Johnson, Laschober & Associates, P.C. (JLA) is a professional architecture, engi... |
| Cambria Automobiles (summitgroup.local) | · Aug 9, 2024 | Cambria Investments Holdings is a diversified organization with a strategic focu... |
| Pyle Group | · Aug 9, 2024 | The Pyle Group are dedicated to managing and protecting your financial future. T... |
| Reef-PCG (pcg.local) | · Aug 9, 2024 | Reef Capital Partners and its subsidiaries specialize in creating and managing v... |
| The Greenhouse People | · Aug 2, 2024 | The Greenhouse People Ltd have been selling greenhouses since 1989 - many of the... |
| True Blue Environmental | · Aug 2, 2024 | True Blue Environmental Services is a full-service environmental and constructio... |
In the newsAll →
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .