Threat Intelligence Report February 25 - March 3 2025

Lynx Ransomware

1. Group Emergence & Characteristics

• Windows & Linux Availability: Lynx Ransomware is distributed in both Windows and Linux flavours. Although the Linux variant is built for ESXi servers, it has not been observed in active attacks yet.
• Mode-Based Encryption: Later versions of Lynx introduced fast/medium/slow/entire encryption modes, allowing attackers to define how much of each file is encrypted - striking different balances between speed and thoroughness. Earlier variants lacked this feature, defaulting to a roughly 16% file encryption scheme.
• Targeted Systems & Extension: Upon encrypting files, Lynx appends the “.LYNX” extension.
  
  

2. Environment Preparation & Privilege Escalation (Windows)

• Privilege Escalation: If the ransomware detects insufficient file access, it automatically enables SeTakeOwnershipPrivilege, takes ownership of target files, and modifies their Discretionary Access Control List (DACL).
• Windows Restart Manager: Processes using targeted files are terminated to ensure uninterrupted encryption.
• Drive Mounting: When load-drives is enabled, Lynx identifies unmounted volumes and assigns them drive letters, expanding its attack surface.
  
  

3. Whitelisted & Blacklisted Entities

• Whitelisted File Extensions: .exe, .dll, .msi, .lynx
• Blacklisted Services (Windows): sql, veeam, backup, exchange
• Blacklisted Processes (Windows): sql, veeam, backup, exchange, java, notepad
  
  

4. Encryption Scheme

• Multi-Threading:
  • Windows: Spawns 4× the number of CPU cores for maximum concurrency.
  • Linux: Spawns 2× CPU cores (optimised for ESXi targeting).
• Algorithm Combination: Uses Curve25519 Donna for key exchange, while file data is encrypted with AES-128 in CTR mode.
• File Extension: Once encrypted, files are renamed with the .LYNX suffix (unless silent mode is specified).
  
  

5. Post-Encryption Actions

• Wallpaper & Print Jobs: Lynx changes the victim’s desktop background to a ransom note and attempts to print the note on connected printers (excluding “Microsoft Print to PDF” and “Microsoft XPS Document Writer”).
• ESXi-Specific Scripts (Linux):
  • Killing VMs: Writes a script named kill, which force-terminates all virtual machines on an ESXi host by enumerating their “World IDs”:

for i in $(esxcli vm process list | grep 'World' | grep -Eo '[0-9]{1,8}'); do esxcli vm process kill -t=force -w=$i; done

• Removing Snapshots: Writes a script named delete to remove all snapshots on each ESXi VM

for i in $(vim-cmd vmsvc/getallvms | awk '{print $1}' | grep -Eo '[0-9]{1,8}'); do vim-cmd vmsvc/snapshot.removeall $i; done

Detailed TTPs

The table below maps Lynx Ransomware tactics to MITRE ATT&CK techniques:

IOCs

• File Hash

• Lynx URLs

Ransomware Victims Worldwide

A recent ransomware analysis reveals that the United States continues to be the most heavily impacted nation, accounting for an extraordinary 71.5% of all documented ransomware incidents—underscoring its pronounced vulnerability to such cyber threats. Following this, Canada emerges as the second most targeted region with 6.36% of reported attacks, followed by the United Kingdom at 4.33%.

Notably, Germany experiences 2.29% of observed attacks, while Mexico registers 2.04%. Further highlighting the global scope of ransomware threats, Australia and France each account for 1.53% of incidents. Spain, cumulatively at 1.52% (combining two reported entries), and Brazil with 1.02% also show considerable impact.

Other countries collectively reporting under 1% include New Zealand, Italy, and India at 0.76%, alongside Egypt, Sweden, Saudi Arabia, Singapore, Peru, and Japan at 0.51%. A broader group of nations—such as Taiwan, Netherlands, Ireland, Indonesia, China, Chile, Austria, Thailand, Palau, Colombia, and more—each report 0.25% of global ransomware cases, indicating that no single region remains untouched by these attacks.

This analysis highlights the persistent, worldwide reach of ransomware operations, with North America once again facing disproportionately high risks. As threats proliferate, the need for robust cybersecurity measures, proactive defence strategies, and cross-sector vigilance has never been more critical to mitigate potential impacts on government agencies, businesses, and individuals alike.