Threadlinqs IntelligenceStart free

Threat actorTracked since 2026-06

SantaAd

Also known as:LynxPayload ransomware affiliates

As of 2026-10-06, SantaAd is a threat actor tracked by Threadlinqs Intelligence across 2 threats spanning ransomware, threat intel. Also known as Lynx, Payload ransomware affiliates. ATT&CK coverage spans 35 techniques across 12 tactics in 2 of 2 tracked threats. Most-observed techniques: T1040 (Network Sniffing), T1078 (Valid Accounts), T1110.004 (Brute Force: Credential Stuffing).

Tracked threats
21 critical · 1 high
First seen
2026-06-24
Last seen
2026-10-06
ATT&CK techniques
35across 2 of 2 threats
Related CVEs
3Referenced by its activity
2 tracked threat(s) · Categories: RANSOMWARE, THREAT_INTEL

Activity timeline

SantaAd appears in 2 tracked threats between and ; the busiest month was 2026-06 with 1 report.

ATT&CK techniques observed

35 techniques observed across 2 of 2 tracked threats · Credential Access (6), Lateral Movement (5), Reconnaissance (5), Collection (3), Discovery (3), Initial Access (3)
  • T1040 Network Sniffing — Credential Accessobserved in 2 of 2 tracked threats
  • T1078 Valid Accounts — Initial Accessobserved in 2 of 2 tracked threats
  • T1110.004 Brute Force: Credential Stuffing — Credential Accessobserved in 2 of 2 tracked threats
  • T1133 External Remote Services — Initial Accessobserved in 2 of 2 tracked threats
  • T1550.004 Use Alternate Authentication Material: Web Session Cookie — Lateral Movementobserved in 2 of 2 tracked threats
  • T1595 Active Scanning — Reconnaissanceobserved in 2 of 2 tracked threats
  • T1018 Remote System Discovery — Discoveryobserved in 1 of 2 tracked threats
  • T1021 Remote Services — Lateral Movementobserved in 1 of 2 tracked threats
  • T1021.001 Remote Desktop Protocol — Lateral Movementobserved in 1 of 2 tracked threats
  • T1021.002 SMB/Windows Admin Shares — Lateral Movementobserved in 1 of 2 tracked threats
  • T1039 Data from Network Shared Drive — Collectionobserved in 1 of 2 tracked threats
  • T1041 Exfiltration Over C2 Channel — Exfiltrationobserved in 1 of 2 tracked threats
  • T1046 Network Service Discovery — Discoveryobserved in 1 of 2 tracked threats
  • T1056 Input Capture — Collectionobserved in 1 of 2 tracked threats
  • T1071 Application Layer Protocol — Command and Controlobserved in 1 of 2 tracked threats

Tracked threats

Related CVEs

3 CVEs referenced by tracked SantaAd activity