Lynx Ransomware Group 'Industrializes' Cybercrime With Affiliates
ID: 3559a896-5045-5a9f-b016-28ec768229c2
STIX ID: report--3559a896-5045-5a9f-b016-28ec768229c2
Feed Name: Dark Reading
Date Published: 2025-01-28
Date Updated: 2026-04-21
Author: Kristina Beek, Associate Editor, Dark Reading
Researchers at Group-IB analyzed the Lynx ransomware-as-a-service operation, revealing a highly organized, industrial-scale RaaS with a feature-rich affiliate panel, recruitment/verification processes, cross-platform binaries (Windows, Linux, ESXi), and a public leak site. The report highlights Lynx's 80% affiliate revenue model, operational security emphasis, and recommendations for defenders including MFA, EDR, backups, patching, and security awareness.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.