{"id":94329,"date":"2025-02-28T10:14:56","date_gmt":"2025-02-28T10:14:56","guid":{"rendered":"https:\/\/cybersecuritynews.com\/?p=94329"},"modified":"2025-02-28T10:14:59","modified_gmt":"2025-02-28T10:14:59","slug":"lynx-ransomware-exfiltrate-sensitive-data","status":"publish","type":"post","link":"https:\/\/cybersecuritynews.com\/lynx-ransomware-exfiltrate-sensitive-data\/","title":{"rendered":"Lynx Ransomware Attacking Organizations to Exfiltrate Sensitive Data"},"content":{"rendered":"\n

Lynx, a new ransomware variant, has been rising through the ranks of cyber threats since its initial release in mid-2024.\u00a0\u00a0<\/p>\n\n\n\n

Operating under a Ransomware-as-a-Service (RaaS)<\/a> model, Lynx targets organizations globally through double extortion campaigns, combining file encryption with systematic data theft. <\/p>\n\n\n\n

Recent analyses by Darktrace and cybersecurity firms reveal its technical sophistication, including code reuse from the INC ransomware family and novel attack vectors designed to maximize operational disruption.<\/p>\n\n\n\n

Lynx ransomware distinguishes itself through its hybrid encryption approach, leveraging AES-128 in CTR mode for symmetric encryption and Curve25519 Donna for asymmetric key exchange. <\/p>\n\n\n\n

This dual-layer strategy ensures that even if one encryption component is compromised, the data remains inaccessible without the private key. <\/p>\n\n\n\n

The malware appends the .LYNX extension to encrypted files<\/a> and employs a partial encryption method, overwriting 1MB of every 6MB of a file to balance speed and effectiveness. Smaller files under 1MB are fully encrypted to prevent recovery.<\/p>\n\n\n\n

The group\u2019s command-line interface allows affiliates to customize attacks using flags such as –encrypt-network to target shared drives and –no-print to disable the ransomware\u2019s unique feature of spamming ransom notes to connected printers.<\/p>\n\n\n\n

These notes, typically named README.txt, are Base64-encoded and include payment instructions tied to Tor-based communication channels.<\/p>\n\n\n\n

Infection Vectors and Lateral Movement<\/strong><\/h2>\n\n\n\n

Initial access frequently occurs via phishing campaigns deploying malicious attachments or links. <\/p>\n\n\n\n

Once inside a network, Lynx operators conduct lateral movement using compromised administrative credentials. <\/p>\n\n\n\n

Darktrace observed<\/a> widespread use of default usernames like admin and Administrator across NTLM and Kerberos authentication protocols, suggesting credential stuffing or brute-force attacks. <\/p>\n\n\n\n

Attackers then exploit Server Message Block (SMB) vulnerabilities over port 445 to enumerate file shares and deploy encryption payloads.<\/p>\n\n\n\n

In one December 2024 incident, the lateral movement involved Nmap-based network scanning, and anomalous bind attempts to service control endpoints, indicative of reconnaissance activity.\u00a0<\/p>\n\n\n\n

Post-compromise, the ransomware terminates processes related to backups and security tools using the DeviceIoControl function to delete Volume Shadow Copies (VSS), crippling restoration capabilities.<\/p>\n\n\n\n

Lynx\u2019s double extortion strategy involves exfiltrating sensitive data to cloud storage platforms<\/a> like AWS S3 (e.g., wt-prod-euwest1-storm.s3.eu-west-1.amazonaws[.]com) and exfiltration tools such as WinSCP and rclone. <\/p>\n\n\n\n

Researchers documented a case where 150 GiB of data was extracted from internal devices over port 3260 before being uploaded externally. <\/p>\n\n\n\n

To obfuscate these transfers, attackers abuse legitimate remote management tools like AnyDesk, establishing connections to domains such as relay-48ce591e[.]net[.]anydesk[.]com to maintain persistence.<\/p>\n\n\n\n

The group escalates pressure by gradually leaking stolen data (\u201cdrip-feeding\u201d) and threatening public exposure. In January 2025, this tactic impacted Hunter Taubman Fischer & Li LLC, a U.S. law firm, where leaked client data exposed sensitive corporate litigation details.<\/p>\n\n\n\n

Mitigation<\/strong><\/h2>\n\n\n\n

Organizations are advised to:<\/p>\n\n\n\n