# Lynx Ransomware Intrusion via Valid RDP Credentials - Backup Deletion and Exfiltration via temp.sh

> The DFIR Report documents a nine-day intrusion (~178 hours time to ransomware) that began with an RDP logon using previously compromised valid credentials and ended with Lynx ransomware deployed to backup and file servers. The actor performed network discovery, created look-alike Domain Admin accounts, exfiltrated data via temp.sh, and deleted Veeam backup jobs before encryption.

- **Published:** 2026-10-21T06:05:22Z
- **Last reviewed:** 2026-10-21T06:05:22Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4017
- **ID:** TL-2026-4017
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Lynx ransomware operators
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)

## Description

In an intrusion observed in early March 2025 and published by The DFIR Report on 2025-12-17, the actor logged on over RDP to an internet-exposed host (hostname DESKTOP-BUL6K1U) from 195.211.190.189 using valid credentials. No brute-force activity was observed; the credentials were likely obtained via an infostealer, breach reuse, or an initial access broker. Both the initial-access IP and a follow-up IP (77.90.153.30) belong to Railnet LLC, which the report describes as a front for the Russia-based bulletproof hosting provider Virtualine (advertised on Russian-speaking forums Exploit and XSS since August 2024).

On the first day the actor moved over RDP to a domain controller and used dsa.msc to create three accounts: 'administratr' (Domain Admins and Group Policy Creator Owners) and two look-alike accounts that differed from real account names by a single character, all set with passwords that never expire. The actor tested the new accounts against hypervisors on day 2. Discovery used built-in utilities (ipconfig, route print, systeminfo, lusrmgr.msc, registry queries to identify Hyper-V hosts, secedit /export to C:\secpol.cfg), SoftPerfect Network Scanner v7.2.7 (netscan.exe, results exported to ss.xml) and NetExec (nxc.exe smb sweeps; .nxc workspace artifacts). AnyDesk was installed on the domain controller but not observed in use.

On day 6 the actor browsed file-server shares, archived data with 7-Zip's 'Add to Archive' context menu into the compromised user's Desktop, and uploaded the archives through the browser to temp.sh (/upload). On day 8 the actor extended reconnaissance of backup and virtualization infrastructure and, in the Veeam Backup & Replication console, reviewed backup, tape and storage configuration and deleted backup jobs from the configuration database (seen in a partially recovered RDP bitmap cache). On day 9 the Lynx ransomware payload (w.exe) was executed via cmd.exe on backup and file servers, e.g. 'w.exe --dir E:\ --mode fast --verbose --noprint' (fast mode = 5% encryption ratio). Total time to ransomware was about 178 hours.

Background: Palo Alto Unit 42 (2024-10-10) assessed Lynx as closely related to INC ransomware (48% matched functions, 70.8% when counting shared functions in BinDiff), using AES-128-CTR with Curve25519 Donna, appending the .lynx extension, dropping README.txt, deleting shadow copies and backup partitions, and operating a leak site. Lynx is run as a RaaS with double extortion, targeting SMBs mainly in North America and Europe. No CVE is involved; severity is analyst-assigned from ransomware impact.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1133 External Remote Services
- T1021.001 Remote Services: Remote Desktop Protocol
- T1136.002 Create Account: Domain Account
- T1098.007 Account Manipulation: Additional Local or Domain Groups
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1046 Network Service Discovery
- T1135 Network Share Discovery
- T1018 Remote System Discovery
- T1082 System Information Discovery
- T1087.001 Account Discovery: Local Account
- T1012 Query Registry
- T1219 Remote Access Tools
- T1560.001 Archive Collected Data: Archive via Utility
- T1567 Exfiltration Over Web Service
- T1490 Inhibit System Recovery

## Sources

- [Cat's Got Your Files: Lynx Ransomware](https://thedfirreport.com/2025/12/17/cats-got-your-files-lynx-ransomware/)
- [INC Ransomware Rebrand to Lynx (Unit 42)](https://unit42.paloaltonetworks.com/inc-ransomware-rebrand-to-lynx/)
- [Lynx Ransomware: Exposing How INC Ransomware Rebrands Itself (Picus)](https://www.picussecurity.com/resource/blog/lynx-ransomware)
- [Lynx ransomware: a rebranding of INC ransomware (Gurucul)](https://gurucul.com/latest-threats/lynx-ransomware-a-rebranding-of-inc-ransomware/)
- [Ransom Tales 3 (AttackIQ)](https://www.attackiq.com/2025/08/28/ransom-tales-3/)
- [Lynx Ransomware: Double Extortion, Ethics & Affiliate Payouts (CybelAngel)](https://cybelangel.com/blog/lynx-ransomware-double-extortion/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4017