INC ransomware rebrands to Lynx – same code, new name, still up to no good

**Executive summary:** Unit 42 analysis suggests the INC ransomware group rebranded to Lynx over several months, supported by detection trends, a 70.8% code similarity between samples, near-identical leak-site designs, and continued victim postings; notable past INC victims include NHS Scotland and Leicester City Council, and Lynx publicly claims it will avoid targeting hospitals and nonprofits.