Acronis TRU publishes detailed analysis of INC ransomware
Acronis Threat Research Unit (TRU) has published a detailed analysis of the Lynx ransomware operation, tracing its lineage back to the INC ransomware group that first appeared in 2023. The report maps the full attack chain, including YARA rules and a set of IOCs for the group’s tooling, and places Lynx among the top-tier ransomware-as-a-service (RaaS) operations with more than 800 victims listed since its emergence.
Lynx is a rebranded variant of INC, with substantial code overlap between the two families. The connection stems from INC’s 2024 sale of its source code on a dark web forum, which enabled the development of Lynx as a more advanced variant. The report confirms that Lynx has been active since mid-2024, with the group adding hundreds of victims to its data leak site in 2026 alone.
The attack chain: from ProcessTerminator to Veeam-Get-Creds
The attack chain begins with ProcessTerminator.exe, which the group drops to kill running security processes before the main payload executes. This is followed by Veeam-Get-Creds.ps1, a PowerShell script that extracts Veeam backup credentials from the target, giving the operators access to the backup infrastructure for the exfiltration phase.
Lynx operates a double extortion model. After the initial access and credential extraction, the group encrypts the victim’s data and exfiltrates it to their infrastructure. The exfiltrated data is then published on the group’s data leak site, where victims can verify the files before paying. The encryption and exfiltration happen in the same pass, so the victim’s data is already out the door by the time the ransom note drops.
Who was hit: 800+ victims across healthcare, legal, and tech
United States organizations make up more than 65% of the 800+ victims listed on the group’s data leak site. The remaining share splits across the UK and a handful of other countries, with the UK typically accounting for the next-largest slice. The sector mix skews toward legal services, manufacturing, construction, technology, and health care — the same verticals the group has been hitting since mid-2024. That concentration is consistent with a RaaS model that prioritizes SMBs and mid-market targets over the large enterprise names that usually headline the press.
The group has added hundreds of victims to its data leak site in 2026 alone, putting Lynx in the top tier of active ransomware operations by volume. The pace is steady rather than bursty — the group has been listing victims at a consistent clip since the rebrand, which is what separates it from the one-off affiliates that dump a dozen victims in a single week.
The source code sale that spawned Lynx and Sinobi
The connection between Lynx and INC traces back to a 2024 sale of INC’s source code on a dark web forum. That single transaction spawned two related ransomware families — Lynx and Sinobi — both of which share substantial code overlap with the original INC payload. The sale effectively let a new operator fork the codebase, rebrand it, and ship a more advanced variant under the Lynx name.
The lineage runs deeper than just the code. Security researcher 3xp0rt linked the “salfetka” alias to “rinc” and “farnetwork,” which are themselves tied to five other ransomware operations: Nokoyawa, JSWORM, Nefilim, Karma, and Nemty. That cluster of aliases suggests a shared operator or a tight-knit affiliate ring that has been recycling the same core across multiple brands. Lynx emerged shortly after the forum listing, with Sinobi following a bit later, confirming the fork-and-rebrand pattern in practice.
Key points
- Acronis TRU publishes detailed analysis of INC ransomware with 800+ victims since 2023
- Lynx ransomware is a rebranded INC variant with substantial code overlap, first detected mid-2024
- Full attack chain, YARA rules, and IOCs included in the report
- INC source code sold in 2024 led to emergence of Lynx and Sinobi ransomware families
- US organizations account for 65%+ of listed victims across legal, manufacturing, construction, tech, and healthcare
Further reading & sources
- From emerging threat to top-tier ransomware-as-a-service: The evolution of INC ransomware — Acronis Threat Research Unit
- Opera (web browser) - Wikipedia
- Opera (web browser) - Wikipedia
- VTPRACTITIONERS{SEQRITE}: Tracking UNG0002, Silent Lynx and DragonClone ~ VirusTotal Blog
- Lynx Ransomware: Exposing How INC Ransomware Rebrands Itself
- Abuse of alternative runtime environments Deno-tes defender headaches | SOPHOS
- Sinobi: The bougie-exclusive ransomware group that wants to be a ninja | Barracuda Networks Blog