MSPs a top target for Akira and Lynx ransomware

Acronis TRU analyzes Akira and Lynx ransomware families active in 2024–2025, detailing their RaaS operations, double-extortion behavior, exploitation of VPN/firewall CVEs and stolen credentials, technical encryption and evasion techniques (shadow copy deletion, process termination, printer ransom-note printing), and provides IoCs (SHA256 hashes and multiple .onion C2/leak site URLs); both target SMBs and sometimes MSPs, reuse leaked code elements, and present an ongoing high-risk threat to organizations.