Lynx Ransomware
Screenshot der Akira-Leakseite (Tor Hidden Service)
Allgemeine Informationen
- Erkannt seit: Mitte 2024 (als Nachfolger der INC-Ransomware)
- Modell: Ransomware-as-a-Service (RaaS) mit Affiliate-Struktur
- Verbindung zu: INC-Ransomware (gleiche Codebasis und Operation)
- Opferzahl: Über 90 gelistete Opfer auf Leakseite (Stand Januar 2025), vermutlich deutlich mehr insgesamt
- Zielbranchen: Fertigung, Bau, Energie, Architektur, IT-Infrastruktur, v.a. in den USA, Kanada, UK
- Typische Lösegeldforderungen: Variabel (gemäß Double-Extortion Taktik, genaue Summen selten öffentlich)
Dateiendungen & Ransomnote
.LynxEncrypted(variabel generierte Endung) - Erweiterung verschlüsselter Dateien[RANDOM]-Lynx-README.txt- Erpressernachricht mit Kontaktinformationen
Datei-Hashes
SHA-256:
9d52fc6efc8f23a8a3fca79e5d7b493f6bfb0210e2e3a02b0f843cbf61d3e9d01f6c01ad43f139e560b14a405f3e021b83d020a7124538a6c2fd74d1d0e534d6
Verdächtige Kommandos
vssadmin delete shadows /all /quiet
bcdedit /set {current} safeboot minimal
wmic shadowcopy delete
netsh advfirewall set allprofiles state off
taskkill /f /im sqlwriter.exe
schtasks /change /tn "Microsoft\\Windows\\Defrag\\ScheduledDefrag" /disable
sc stop VeeamTransportSvc
sc stop BackupExecAgentAccelerator
Netzwerkindikatoren
- Remote Tool:
AnyDesk - Remote Tool:
RustDesk - Leak-Site (.onion):
lynxsec2cj32jhdzxx75bcx2acp75tthoyg5ji7ilf4qgwe3l3akssyd.onion - Leak-Site (.onion):
lynxblogxutufossaeawlij3j3uikaloll5ko6grzhkwdclrjngrfoid.onion - Leak-Site (.onion):
lynxblogoxllth4b46cfwlop5pfj4s7dyv37yuy7qn2ftan6gd72hsad.onion - Leak-Site (.onion):
lynxblogmx3rbiwg3rpj4nds25hjsnrwkpxt5gaznetfikz4gz2csyad.onion - Leak-Site (.onion):
lynxblogco7r37jt7p5wrmfxzqze7ghxw6rihzkqc455qluacwotciyd.onion - Leak-Site (.onion):
lynxblogijy4jfoblgix2klxmkbgee4leoeuge7qt4fpfkj4zbi2sjyd.onion - Leak-Site (.onion):
lynxblogtwatfsrwj3oatpejwxk5bngqcd5f7s26iskagfu7ouaomjad.onion
MITRE ATT&CK Mapping
- Initial Access:
T1078- Valid Accounts (z.B. RDP ohne MFA),T1133- External Remote Services - Execution:
T1059- Command and Scripting Interpreter (PowerShell, CMD) - Persistence:
T1547- Boot or Logon Autostart Execution - Privilege Escalation:
T1068- Exploitation for Privilege Escalation - Defense Evasion:
T1562- Impair Defenses (Deaktivierung AV, Löschung Shadow Copies) - Credential Access:
T1003- OS Credential Dumping (z.B. LaZagne, mimikatz) - Discovery:
T1087- Account Discovery,T1018- Remote System Discovery - Lateral Movement:
T1021- Remote Services (SMB, WinRM) - Collection:
T1119- Automated Collection - Exfiltration:
T1041- Exfiltration Over C2 Channel (Rclone, MegaCLI) - Impact:
T1486- Data Encrypted for Impact,T1490- Inhibit System Recovery
Ransomnote - Beispiel A
Your data is stolen and encrypted.
Your unique identificator is [snip]
Use this TOR site to contact with us:
http://lynxch2k5xi35j7hlbmwl7d6u2oz4vp2wqp6qkwol624cod3d6iqiyqd.onion/login
Use this email to contact with us:
martina.lestariid1898@proton.me
Our blog
~ TOR Network: http://lynxbllrfr5262yvbgtqoyq76s7mpztcqkv6tjjxgpilpma7nyoeohyd.onion/disclosures
~ Mirror #1: http://lynxblog.net/
Ransomnote - Beispiel B
Your data is stolen and encrypted.
Download TOR Browser to contact with us.
ID
~ [snip]
Chat site:
~ TOR Network: http://lynxchatly4zludmhmi75jrwhycnoqvkxb4prohxmyzf4euf5gjxroad.onion/login
~ TOR Mirror #1: http://lynxchatfw4rgsclp4567i4llkqjr2kltaumwwobxdik3qa2oorrknad.onion/login
~ TOR Mirror #2: http://lynxchatohmppv6au67lloc2vs6chy7nya7dsu2hhs55mcjxp2joglad.onion/login
~ TOR Mirror #3: http://lynxchatbykq2vycvyrtjqb3yuj4ze2wvdubzr2u6b632trwvdbsgmyd.onion/login
~ TOR Mirror #4: http://lynxchatde4spv5x6xlwxf47jdo7wtwwgikdoeroxamphu3e7xx5doqd.onion/login
~ TOR Mirror #5: http://lynxchatdy3tgcuijsqofhssopcepirjfq2f4pvb5qd4un4dhqyxswqd.onion/login
~ TOR Mirror #6: http://lynxchatdykpoelffqlvcbtry6o7gxk3rs2aiagh7ddz5yfttd6quxqd.onion/login
~ TOR Mirror #7: http://lynxch2k5xi35j7hlbmwl7d6u2oz4vp2wqp6qkwol624cod3d6iqiyqd.onion/login
Our blog:
~ TOR Network: http://lynxblogxstgzsarfyk2pvhdv45igghb4zmthnzmsipzeoduruz3xwqd.onion/
~ TOR Mirror #1: http://lynxblogco7r37jt7p5wrmfxzqze7ghxw6rihzkqc455qluacwotciyd.onion/
~ TOR Mirror #2: http://lynxblogijy4jfoblgix2klxmkbgee4leoeuge7qt4fpfkj4zbi2sjyd.onion/
~ TOR Mirror #3: http://lynxblogmx3rbiwg3rpj4nds25hjsnrwkpxt5gaznetfikz4gz2csyad.onion/
~ TOR Mirror #4: http://lynxblogoxllth4b46cfwlop5pfj4s7dyv37yuy7qn2ftan6gd72hsad.onion/
~ TOR Mirror #5: http://lynxblogtwatfsrwj3oatpejwxk5bngqcd5f7s26iskagfu7ouaomjad.onion/
~ TOR Mirror #6: http://lynxblogxutufossaeawlij3j3uikaloll5ko6grzhkwdclrjngrfoid.onion/
~ Mirror #7: http://lynxblog.net/
Externe Analysen & Bedrohungsprofile
Indicators of Compromise (IOCs)
Dateiendung(en): *.LynxEncrypted (variabel pro Angriff)
Ransom Note: *-Lynx-README.txt
Leak Site (Tor): lynxsec2cj32jhdzxx75bcx2acp75tthoyg5ji7ilf4qgwe3l3akssyd.onion
Verdächtige Prozesse: psexesvc.exe, sqlwriter.exe, defrag.exe
Remote Tools: AnyDesk, RustDesk, WinSCP
Command-Line IOCs:
- vssadmin delete shadows /all /quiet
- bcdedit /set {current} safeboot minimal
- wmic shadowcopy delete
- netsh advfirewall set allprofiles state off
- schtasks /change /tn \"Microsoft\Windows\Defrag\ScheduledDefrag\" /disable
- sc stop VeeamTransportSvc
Hash-Beispiel (SHA256):
- 9d52fc6efc8f23a8a3fca79e5d7b493f6bfb0210e2e3a02b0f843cbf61d3e9d0
- 1f6c01ad43f139e560b14a405f3e021b83d020a7124538a6c2fd74d1d0e534d6