Lynx Ransomware: A Rebranding of INC Ransomware

**Executive summary:** Palo Alto Networks Unit42 reports on Lynx ransomware, a successor to INC ransomware used in active double-extortion campaigns against organizations in retail, real estate, architecture, financial and environmental services in the U.S. and UK; the report includes technical analysis (Windows samples using AES-128-CTR and Curve25519, .lynx file extension, process termination, shadow copy deletion, use of Restart Manager, OneNote reporting), operational details (RaaS model, phishing/malicious downloads, public Tor leak sites), and multiple IoCs (SHA256 hashes, contact email, Tor URLs) to support detection and mitigation.