Ransomware group profile · #18 by claimed victims

Lynx ransomware

Lynx is a ransomware-as-a-service operation that emerged in mid-2024 as a rebrand of INC Ransomware (whose source code was sold for $300,000 on the RAMP forum), claiming ~300 victims across manufacturing, business services, technology, and transportation with an 80/20 profit split for affiliates.

Active First seen Jul 2024

417Victims claimed on leak sites

0Victims in the last 30 days

3Victims in the last 90 days

48Countries hit

36Leak-site URLs tracked, 0 online

29 Aug 2026Latest claim recorded

Victimology

Who Lynx claims to have breached, from 417 leak-site posts recorded by VULONE.

Claims per month last 12 months

Top sectors

Manufacturing93

Professional Services89

Technology49

Transportation29

Retail & E-Commerce25

Agriculture and Food Production23

Financial Services23

Healthcare20

Top countries

United States219

United Kingdom29

Canada22

Germany17

Australia16

Italy9

France9

Singapore8

Latest claimed victims 12 most recent

Victim	Sector	Country	Claimed
cutlercapital	Financial Services	-	29 Aug 2026
www.jerryleigh.com jerryleigh.com	Other	US	6 Aug 2026
www.talbotdes.org talbotdes.org	Other	GB	6 Aug 2026
www.someco.com someco.com	Not Found	-	18 Jun 2026
www.eastersealsia.org eastersealsia.org	Healthcare	US	18 Jun 2026
www.wolfconstruction.net wolfconstruction.net	Manufacturing	US	18 Jun 2026
www.commonwealth-partners.com commonwealth-partners.com	Professional Services	GB	11 Jun 2026
lifelongaccess.org lifelongaccess.org	Healthcare	US	10 May 2026
st-annes.uk.com st-annes.uk.com	Education	GB	10 May 2026
bayareaherbs.com bayareaherbs.com	Retail & E-Commerce	US	10 May 2026
jacksoncountyin.com jacksoncountyin.com	Government & Defense	US	10 May 2026
ossistemes.com ossistemes.com	Technology	ES	10 May 2026

All 417 Lynx victims, searchable

Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.

Start free Sign in

Tactics, techniques and procedures

ATT&CK technique mapping for Lynx is in progress. Victimology, infrastructure status and leak-site tracking are live above.

Indicators, detections and the full playbook

Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.

See full IOCs

Frequently asked

Is Lynx ransomware still active?

Lynx is tracked as active. The most recent leak-site claim VULONE recorded is dated 29 August 2026.

How many victims has Lynx claimed?

VULONE has recorded 417 leak-site victim claims attributed to Lynx since July 2024, across 48 countries and 14 sectors.

Which industries does Lynx target?

The sectors most often named on the Lynx leak site are Manufacturing, Professional Services, Technology.

Which countries are most affected by Lynx?

Most Lynx victims recorded by VULONE are located in United States, United Kingdom, Canada.

Where does VULONE get Lynx victim data?

Claims are collected continuously from the group's own leak sites and cross-checked with ransomware.live and RansomLook. A claim is the group's assertion, not a confirmed breach.

Other ransomware groups

Victim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 31 October 2026. Questions or corrections: research@vulone.com.