Threat reportRansomwareTL-2026-4017
Lynx Ransomware Intrusion via Valid RDP Credentials - Backup Deletion and Exfiltration via temp.sh
Lynx Ransomware Intrusion via Valid RDP Credentials (TL-2026-4017), also tracked as Lynx ransomware intrusion, is a high-severity ransomware operation, first published 2026-10-21. It is attributed to Lynx ransomware operators with low confidence, affects Microsoft Windows Server / Remote Desktop Services (internet-exposed, maps to 16 MITRE ATT&CK techniques (T1012, T1018, T1021.001), and is covered by 9 detection rules and 27 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 16MITRE ATT&CK
- Actors
- 1Lynx ransomware operators
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 27Indicators of compromise
Key facts for TL-2026-4017
- Threat ID
- TL-2026-4017
- Also known as
- Lynx ransomware intrusion, Cat's Got Your Files
- Severity
- HIGH
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution
- Lynx ransomware operators
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- manufacturing, energy, legal, retail, real-estate, finance, engineering
- Target regions
- North America, Europe
- Detection rules
- 9
- Indicators of compromise
- 27
Malware and tooling in Lynx Ransomware Intrusion via Valid RDP Credentials
Malware and tooling: AnyDesk, INC Ransomware - S1139, Lynx, Lynx ransomware, AnyDesk, NetExec, Netscan, SoftPerfect Network Scanner
How Lynx Ransomware Intrusion via Valid RDP Credentials works
The DFIR Report documents a nine-day intrusion (~178 hours time to ransomware) that began with an RDP logon using previously compromised valid credentials and ended with Lynx ransomware deployed to backup and file servers. The actor performed network discovery, created look-alike Domain Admin accounts, exfiltrated data via temp.sh, and deleted Veeam backup jobs before encryption.
In an intrusion observed in early March 2025 and published by The DFIR Report on 2025-12-17, the actor logged on over RDP to an internet-exposed host (hostname DESKTOP-BUL6K1U) from 195.211.190.189 using valid credentials. No brute-force activity was observed; the credentials were likely obtained via an infostealer, breach reuse, or an initial access broker. Both the initial-access IP and a follow-up IP (77.90.153.30) belong to Railnet LLC, which the report describes as a front for the Russia-based bulletproof hosting provider Virtualine (advertised on Russian-speaking forums Exploit and XSS since August 2024).
On the first day the actor moved over RDP to a domain controller and used dsa.msc to create three accounts: 'administratr' (Domain Admins and Group Policy Creator Owners) and two look-alike accounts that differed from real account names by a single character, all set with passwords that never expire. The actor tested the new accounts against hypervisors on day 2. Discovery used built-in utilities (ipconfig, route print, systeminfo, lusrmgr.msc, registry queries to identify Hyper-V hosts, secedit /export to C:\secpol.cfg), SoftPerfect Network Scanner v7.2.7 (netscan.exe, results exported to ss.xml) and NetExec (nxc.exe smb sweeps; .nxc workspace artifacts). AnyDesk was installed on the domain controller but not observed in use.
On day 6 the actor browsed file-server shares, archived data with 7-Zip's 'Add to Archive' context menu into the compromised user's Desktop, and uploaded the archives through the browser to temp.sh (/upload). On day 8 the actor extended reconnaissance of backup and virtualization infrastructure and, in the Veeam Backup & Replication console, reviewed backup, tape and storage configuration and deleted backup jobs from the configuration database (seen in a partially recovered RDP bitmap cache). On day 9 the Lynx ransomware payload (w.exe) was executed via cmd.exe on backup and file servers, e.g. 'w.exe --dir E:\ --mode fast --verbose --noprint' (fast mode = 5% encryption ratio). Total time to ransomware was about 178 hours.
Background: Palo Alto Unit 42 (2024-10-10) assessed Lynx as closely related to INC ransomware (48% matched functions, 70.8% when counting shared functions in BinDiff), using AES-128-CTR with Curve25519 Donna, appending the .lynx extension, dropping README.txt, deleting shadow copies and backup partitions, and operating a leak site. Lynx is run as a RaaS with double extortion, targeting SMBs mainly in North America and Europe. No CVE is involved; severity is analyst-assigned from ransomware impact.
MITRE ATT&CK techniques used in TL-2026-4017
Discovery
T1012 Query Registry; T1018 Remote System Discovery; T1046 Network Service Discovery; T1082 System Information Discovery; T1087.001 Account Discovery: Local Account; T1135 Network Share Discovery
Lateral Movement
T1021.001 Remote Services: Remote Desktop Protocol
Execution
T1059.003 Command and Scripting Interpreter: Windows Command Shell
Initial Access
T1078 Valid Accounts; T1133 External Remote Services
Privilege Escalation
T1098.007 Account Manipulation: Additional Local or Domain Groups
Persistence
T1136.002 Create Account: Domain Account
Command and Control
Impact
Collection
T1560.001 Archive Collected Data: Archive via Utility
Exfiltration
Affected products and versions in Lynx Ransomware Intrusion via Valid RDP Credentials
- Microsoft — Windows Server / Remote Desktop Services (internet-exposed RDP)
Vulnerable versions: Configurations exposing RDP with single-factor valid credentials - Veeam — Veeam Backup & Replication (backup job deletion via console)
Vulnerable versions: Instances reachable from compromised domain admin context
Remediation for Lynx Ransomware Intrusion via Valid RDP Credentials
Immediate actions
- Block 195.211.190.189 and 77.90.153.30 at the perimeter and review RDP logs for logons from them
- Audit Active Directory for recently created accounts, especially look-alike names (e.g. administratr) and Domain Admins/Group Policy Creator Owners membership changes
- Reset credentials for any accounts exposed to the beachhead host and rotate Veeam service credentials
- Hunt for netscan.exe, nxc.exe, w.exe, C:\secpol.cfg, .nxc directories and AnyDesk installs on servers
- Review proxy/DNS logs for connections to temp.sh and large outbound uploads
Workarounds
- Restrict RDP by source IP allowlist and enforce Network Level Authentication
- Application-control to block unsigned/unapproved scanners, NetExec and remote-access tools
Longer-term hardening
- Remove direct RDP exposure to the internet; require VPN with MFA or an RD Gateway with MFA
- Monitor for credentials in infostealer logs and breach corpora and force resets
- Keep immutable/offline backups and restrict access to the Veeam console and configuration database
- Alert on account creation, group changes and password-never-expires flags on privileged accounts
- Restrict outbound access to anonymous file-sharing sites and unsanctioned remote-access tools
Weaknesses (CWE) in Lynx Ransomware Intrusion via Valid RDP Credentials
Timeline of Lynx Ransomware Intrusion via Valid RDP Credentials
- Virtualine (operating via Railnet LLC) begins advertising bulletproof hosting on Russian-speaking forums Exploit and XSS (August 2024, per The DFIR Report); exact day not stated.
- Palo Alto Unit 42 publishes analysis linking Lynx ransomware to INC ransomware (48% matched functions, 70.8% including shared functions).
- Approximate (report states early March 2025, day 1): actor logs on via RDP from 195.211.190.189 with valid credentials to host DESKTOP-BUL6K1U, then moves to the domain controller and creates three Domain Admin-level accounts, including look-alikes.
- Approximate (day 2): new accounts tested against hypervisors; netscan and NetExec discovery activity occurs across the early days.
- Approximate (day 6): file-share data archived with 7-Zip and uploaded through the browser to temp.sh.
- Approximate (day 8): extended reconnaissance of backup and virtualization infrastructure; Veeam Backup & Replication jobs reviewed and deleted.
- Approximate (day 9, ~178 hours after initial access): Lynx ransomware (w.exe) executed via RDP/cmd.exe on backup and file servers.
- The DFIR Report publishes 'Cat's Got Your Files: Lynx Ransomware'.
Sources cited for Lynx Ransomware Intrusion via Valid RDP Credentials
- Cat's Got Your Files: Lynx Ransomware
- INC Ransomware Rebrand to Lynx (Unit 42)
- Lynx Ransomware: Exposing How INC Ransomware Rebrands Itself (Picus)
- Lynx ransomware: a rebranding of INC ransomware (Gurucul)
- Ransom Tales 3 (AttackIQ)
- Lynx Ransomware: Double Extortion, Ethics & Affiliate Payouts (CybelAngel)
Detection coverage for TL-2026-4017
As of 2026-10-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4017 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-4017
1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.