Cat’s out of the bag: Lynx Ransomware-as-a-Service

This Group-IB blog provides an in-depth technical analysis of the Lynx ransomware RaaS operator, exposing its affiliate panel, recruitment posts, multi-architecture malware archive (Windows, Linux, ESXi across many CPU architectures), configurable encryption modes using Curve25519 and AES-128, victim management and scheduled leak-site functionality, plus published IOCs, MITRE ATT&CK mappings, and recommended mitigations for defenders.