Netskope Threat Labs

Lynxransom

ATP Sandbox Adv. Heuristics

Lynxransom refers to detections of the Lynx ransomware operation, a ransomware as a service group that emerged in 2024 from the Babuk code base. Its affiliates pressure victims with data theft and encryption, and researchers have tracked it targeting small and mid sized organizations across multiple sectors.

First seen
September 2024
Last seen
October 2026
Alert Name
Win32.Ransomware.Lynxransom