Lynx, a newer ransomware variant, has been gaining ground as a cyber threat since its first appearance in mid-2024
See also: Southern Water: Black Basta ransomware attack cost £4.5m
Lynx, following the Ransomware-as-a-Service (RaaS) model, attacks organizations around the world through dual extortion strategies, combining file encryption with organized data theft.
Recent studies by Darktrace and other cybersecurity firms reveal the sophistication of this technique, including code reuse from the INC ransomware family, as well as the development of new attack methods designed to maximize operational disruption.
Lynx ransomware stands out with its unique approach to encryption, combining AES-128 in CTR mode for symmetric encryption and Curve25519 Donna for asymmetric key exchange.
See also: Confluence Server vulnerability allows LockBit Ransomware attacks
This two-level strategy ensures that even if one encryption element is compromised, the data remains inaccessible without the private key.
The malware appends the .LYNX to encrypted files. It uses a partial encryption method, where 1MB of every 6MB of a file is encrypted. This strikes a balance between speed and efficiency. For files smaller than 1MB, full encryption is applied to prevent recovery.
The team's command-line interface allows collaborators to customize attacks using flags such as –encrypt-network to target shared drives and –no-print to disable the Lynx ransomware's unique ability to spam ransom notes to connected printers.
These notes, usually called README.txt , are Base64 encoded and include payment instructions linked to Tor-based communication channels.
See also: CL0P Ransomware attacks telecom and healthcare sectors
How to protect yourself?
To protect yourself from RaaS, it is important to be cautious of emails from unknown sources. Also, installing a reliable antivirus and regularly updating security systems can reduce the risk.
Additionally, if you use services like Microsoft 365 or Bitdefender Total Security, you can take advantage of the built-in security tools for extra protection.
☁️ Keep safe copies with Proton Drive
Encrypted cloud storage from Proton — protect your files from ransomware, corruption, and data loss with end-to-end encryption.
- ✔ End-to-end encrypted files & backups
- ✔ Version history — recover files after ransomware
- ✔ Free space — sync across all devices
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Source: cybersecuritynews
