Description Summary
176 attacks in 2025; rapid affiliate migration from Lynx.
Threat Actor
Closed hybrid RaaS; rebrand/successor of Lynx (which inherited INC Ransom code); double extortion.
Technical Indicators
Encryption Extension
Not publicly reported
Encryption Algorithm
Curve25519 + AES-128 (CTR) lineage — successor to Lynx (63% code) → INC Ransom (56%)
Ransom Note Name
Not publicly reported
Targeted Industries
Manufacturing, Healthcare, Financial, Education
First Seen
June 2025
Last Seen
Active (176 attacks in 2025)
Geographical Location
Global; US-heavy (19 countries)
MITRE ATT&CK Matrix
| Tactic | TTP | Technique Name |
|---|---|---|
| Impact x 2 | T1486 | Data Encrypted for Impact |
| T1490 | Inhibit System Recovery | |
| Exfiltration x 1 | T1567 | Exfiltration Over Web Service (leak site) |
| Initial Access x 2 | T1190 | Exploit Public-Facing Application |
| T1078 | Valid Accounts |