Lynx Ransomware Group Adds Affiliates to ‘Industrialize’

NEWS BRIEF

The Lynx ransomware-as-a-service (RaaS) group has made a name for itself, standing out as a “highly organized platform” complete with a structured affiliate program and robust encryption methods.

Researchers at Group IB investigated Lynx’s operations and detailed how the group orchestrates its ransomware attacks and manages its list of victims.

Lynx’s affiliate panel is divided into sections, such as news, companies, chats, leaks, and more. This “user-friendly” interface allows affiliates to create victim profiles, generate ransomware samples, and even manage schedules, among a variety of other features. The group provides its affiliates with an “All-in-One Archive” that contains binaries for Windows, Linux, and ESXi environments. It also has a competitive recruitment-driven strategy that incentivizes affiliates with an 80% share of ransom proceeds and a leak site dedicated to posting stolen data publicly if a ransom goes unpaid. 

The group’s recruitment operation requires a lengthy verification process for pen testers and skilled intrusion teams, detailing how the group emphasizes quality control, operational security, along with sufficient skills and experience before being able to join the business.

Using these strategies and more, Lynx has established itself as what the researchers consider to be a “formidable RaaS operator.” By combining ransomware builds, a structured affiliate ecosystem, and a detailed management system, the group has created “an industrial-scale approach to cybercrime.”

The researchers recommend that organizations take essential steps to protect their operations, especially if they are within a critical industrial sector, by implementing multifactor authentication and credential-based access, deploying advanced endpoint detection and response solutions, scheduling backups, prioritizing updates and security awareness programs, and more. Further details can be found in Group-IB’s research blog post.