Darktrace Details Lynx Ransomware Tactics and a Customer Network Compromise
Summary
Darktrace analyzes Lynx ransomware’s tactics and a December 2024 customer compromise involving lateral movement, suspected stolen admin credentials, data exfiltration, AnyDesk use, and SMB-based file encryption.
Key points
- Lynx emerged in 2024 as a ransomware-as-a-service strain whose malware shares substantial source code with INC ransomware.
- The group uses phishing and double extortion, exfiltrating data before encryption and sometimes releasing it in small batches.
- In a December 2024 customer incident, Darktrace observed SMB enumeration, network scanning, and lateral movement using administrative credentials.
- The affected device downloaded about 150 GiB from internal systems, then uploaded data to an external AWS S3 bucket.
- Outbound connections suggested the use of AnyDesk for remote access; thousands of files were subsequently encrypted and given a Lynx extension.
- Autonomous Response was configured to require human confirmation, so the customer’s security team had to apply suggested containment actions.
Article Details
- Attack Vectors
- Phishing emails that prompt user interaction and lead to ransomware download and installation.
- Use of administrative credentials, including 'admin' and 'administrator'; the article says these may have been compromised default credentials, but the initial access point was not confirmed.
- Lateral movement involving SMB enumeration and connections over port 445 and other privileged ports.
- Data exfiltration before encryption, including a reported transfer to an external AWS S3 bucket.
- Remote access behavior suggesting use of AnyDesk by ransomware operators.
- Defensive Notes
- Monitor for unusual administrative credential use through NTLM and Kerberos, SMB enumeration and lateral movement, network scanning, and anomalous internal or external data transfers.
- Monitor for unusual SMB read/write and move activity and files with the '.LYNX' or '.Lynx' extension.
- Darktrace / NETWORK identified the activity and suggested Autonomous Response actions; in the described incident, actions required human confirmation.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| HOSTNAME | relay-48ce591e[.]net[.]anydesk[.]com | AnyDesk relay hostname contacted outbound by the affected device; the article assesses that the tool was used by ransomware operators. |
| HOSTNAME | relay-c9990d24[.]net[.]anydesk[.]com | AnyDesk relay hostname contacted outbound by the affected device; the article assesses that the tool was used by ransomware operators. |
| HOSTNAME | relay-da1ad7b4[.]net[.]anydesk[.]com | AnyDesk relay hostname contacted outbound by the affected device; the article assesses that the tool was used by ransomware operators. |
| HOSTNAME | wt-prod-euwest1-storm[.]s3[.]eu-west-1[.]amazonaws[.]com | External AWS S3 bucket to which the affected device uploaded data during the reported incident. |
MITRE ATT&CK
T1036.003 · Rename Legitimate UtilitiesThe article lists this technique in its ATT&CK mapping; it does not provide article-specific behavior explaining its application.T1080 · Taint Shared ContentThe article's mapping associates this technique with lateral movement; the incident included SMB activity across destination network devices.T1486 · Data Encrypted for ImpactLynx encrypted thousands of files, appending the '.Lynx' extension.
People
Threat Actors
Malware
Vendors
Products
AWS S3from internal network devices. The device then proceeded to upload large volumes of data to the external AWS S3 storage bucket: wt-prod-euwest1-storm.s3.eu-west-1.amazonaws[.]com. Usage of external cloud storageDarktrace / NETWORKIn cases of Lynx ransomware observed across the Darktrace customer base, Darktrace / NETWORK identified and suggested Autonomous Response actions to contain network compromises from the onset of activity.
Tools
Countries
Asia-Pacificteams also identified Lynx incidents affecting energy and retail organizations in the Middle East and Asia-Pacific (APAC) regions. Despite being a relatively new actor, Lynx’s malware shares large portions of itsMiddle EastThreat Research teams also identified Lynx incidents affecting energy and retail organizations in the Middle East and Asia-Pacific (APAC) regions. Despite being a relatively new actor, Lynx’s malware shares large
Industries
Architecturelandscape. This Ransomware-as-a-Service (RaaS) strain is known to target organizations in the finance, architecture, and manufacturing sectors [1] [2]. However, Darktrace’s Threat Research teams also identified LynxEnergysectors [1] [2]. However, Darktrace’s Threat Research teams also identified Lynx incidents affecting energy and retail organizations in the Middle East and Asia-Pacific (APAC) regions. Despite being a relativelyfinancethe threat landscape. This Ransomware-as-a-Service (RaaS) strain is known to target organizations in the finance, architecture, and manufacturing sectors [1] [2]. However, Darktrace’s Threat Research teams alsoManufacturing(RaaS) strain is known to target organizations in the finance, architecture, and manufacturing sectors [1] [2]. However, Darktrace’s Threat Research teams also identified Lynx incidents affectingRetail[1] [2]. However, Darktrace’s Threat Research teams also identified Lynx incidents affecting energy and retail organizations in the Middle East and Asia-Pacific (APAC) regions. Despite being a relatively new actor,