The group’s command-line interface allows affiliates to customize attacks using flags such as –encrypt-network to target shared drives and –no-print to disable the ransomware’s unique feature of spamming ransom notes to connected printers. Post-compromise, the ransomware terminates processes related to backups and security tools using the DeviceIoControl function to delete Volume Shadow Copies (VSS), crippling restoration capabilities. Recent analyses by Darktrace and cybersecurity firms reveal its technical sophistication, including code reuse from the INC ransomware family and novel attack vectors designed to maximize operational disruption. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Kaaviya is a Security Editor and fellow reporter with Cyber Security News. Lynx, a new ransomware variant, has been rising through the ranks of cyber threats since its initial release in mid-2024. The malware appends the .LYNX extension to encrypted files and employs a partial encryption method, overwriting 1MB of every 6MB of a file to balance speed and effectiveness. To obfuscate these transfers, attackers abuse legitimate remote management tools like AnyDesk, establishing connections to domains such as relay-48ce591e[.]net[.]anydesk[.]com to maintain persistence. As Lynx continues to evolve, its blend of technical sophistication and psychological warfare ensures it remains a critical threat to global enterprises in 2025 and beyond. In January 2025, this tactic impacted Hunter Taubman Fischer & Li LLC, a U.S. law firm, where leaked client data exposed sensitive corporate litigation details. In one December 2024 incident, the lateral movement involved Nmap-based network scanning, and anomalous bind attempts to service control endpoints, indicative of reconnaissance activity. Attackers then exploit Server Message Block (SMB) vulnerabilities over port 445 to enumerate file shares and deploy encryption payloads. She is covering various cyber security incidents happening in the Cyber Space.
This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 28 Feb 2025 10:15:21 +0000