[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fNaOHCon1kFFgMWG6xP1CTc1PIhFPPHEt5zGd2OoUe1k":3,"$fD5zS4U_5jiZFr9iZKIU7cM2jMMXWEPqW6HcZfyiFO10":67},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":15,"hero_image_url":16,"structured":17,"story_type":64,"created_at":65,"updated_at":66,"published_at":22},"acronis-tru-details-inc-ransomware-evolution-with-800-victims-and-yara-rules","Acronis TRU details INC ransomware evolution with 800+ victims and YARA rules","Lynx ransomware is a rebranded INC variant with full attack chain, YARA rules, and IOCs published by Acronis Threat Research Unit.","Acronis Threat Research Unit publishes a detailed analysis of INC ransomware, tracing its evolution from an emerging RaaS operation to a top-tier group with 800+ victims since 2023, including full attack chain, YARA rules, and IOCs.",[10,11,12,13,14],"ransomware","INC","Lynx","Acronis","RaaS","# Acronis TRU details INC ransomware evolution with 800+ victims and YARA rules\n\n*Lynx ransomware is a rebranded INC variant with full attack chain, YARA rules, and IOCs published by Acronis Threat Research Unit.*\n\n**Tags:** `ransomware` `INC` `Lynx` `Acronis` `RaaS`\n\n> Acronis Threat Research Unit publishes a detailed analysis of INC ransomware, tracing its evolution from an emerging RaaS operation to a top-tier group with 800+ victims since 2023, including full attack chain, YARA rules, and IOCs.\n\n---\n\n## Acronis TRU publishes detailed analysis of INC ransomware\n\nAcronis Threat Research Unit (TRU) has published a detailed analysis of the Lynx ransomware operation, tracing its lineage back to the INC ransomware group that first appeared in 2023. The report maps the full attack chain, including YARA rules and a set of IOCs for the group’s tooling, and places Lynx among the top-tier ransomware-as-a-service (RaaS) operations with more than 800 victims listed since its emergence.\n\nLynx is a rebranded variant of INC, with substantial code overlap between the two families. The connection stems from INC’s 2024 sale of its source code on a dark web forum, which enabled the development of Lynx as a more advanced variant. The report confirms that Lynx has been active since mid-2024, with the group adding hundreds of victims to its data leak site in 2026 alone.\n\n## The attack chain: from ProcessTerminator to Veeam-Get-Creds\n\nThe attack chain begins with `ProcessTerminator.exe`, which the group drops to kill running security processes before the main payload executes. This is followed by `Veeam-Get-Creds.ps1`, a PowerShell script that extracts Veeam backup credentials from the target, giving the operators access to the backup infrastructure for the exfiltration phase.\n\nLynx operates a double extortion model. After the initial access and credential extraction, the group encrypts the victim’s data and exfiltrates it to their infrastructure. The exfiltrated data is then published on the group’s data leak site, where victims can verify the files before paying. The encryption and exfiltration happen in the same pass, so the victim’s data is already out the door by the time the ransom note drops.\n\n## Who was hit: 800+ victims across healthcare, legal, and tech\n\nUnited States organizations make up more than 65% of the 800+ victims listed on the group’s data leak site. The remaining share splits across the UK and a handful of other countries, with the UK typically accounting for the next-largest slice. The sector mix skews toward legal services, manufacturing, construction, technology, and health care — the same verticals the group has been hitting since mid-2024. That concentration is consistent with a RaaS model that prioritizes SMBs and mid-market targets over the large enterprise names that usually headline the press.\n\nThe group has added hundreds of victims to its data leak site in 2026 alone, putting Lynx in the top tier of active ransomware operations by volume. The pace is steady rather than bursty — the group has been listing victims at a consistent clip since the rebrand, which is what separates it from the one-off affiliates that dump a dozen victims in a single week.\n\n## The source code sale that spawned Lynx and Sinobi\n\nThe connection between Lynx and INC traces back to a 2024 sale of INC’s source code on a dark web forum. That single transaction spawned two related ransomware families — Lynx and Sinobi — both of which share substantial code overlap with the original INC payload. The sale effectively let a new operator fork the codebase, rebrand it, and ship a more advanced variant under the Lynx name.\n\nThe lineage runs deeper than just the code. Security researcher 3xp0rt linked the “salfetka” alias to “rinc” and “farnetwork,” which are themselves tied to five other ransomware operations: Nokoyawa, JSWORM, Nefilim, Karma, and Nemty. That cluster of aliases suggests a shared operator or a tight-knit affiliate ring that has been recycling the same core across multiple brands. Lynx emerged shortly after the forum listing, with Sinobi following a bit later, confirming the fork-and-rebrand pattern in practice.\n\n## Key points\n\n- Acronis TRU publishes detailed analysis of INC ransomware with 800+ victims since 2023\n- Lynx ransomware is a rebranded INC variant with substantial code overlap, first detected mid-2024\n- Full attack chain, YARA rules, and IOCs included in the report\n- INC source code sold in 2024 led to emergence of Lynx and Sinobi ransomware families\n- US organizations account for 65%+ of listed victims across legal, manufacturing, construction, tech, and healthcare\n\n## Further reading & sources\n\n- [From emerging threat to top-tier ransomware-as-a-service: The evolution of INC ransomware](https:\u002F\u002Fwww.acronis.com\u002Fen\u002Ftru\u002Fposts\u002Ffrom-emerging-threat-to-top-tier-ransomware-as-a-service-the-evolution-of-inc-ransomware) — Acronis Threat Research Unit\n- [Opera (web browser) - Wikipedia](https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FOpera_(web_browser))\n- [Opera (web browser) - Wikipedia](https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FOpera.com)\n- [VTPRACTITIONERS{SEQRITE}:  Tracking UNG0002, Silent Lynx and DragonClone ~ VirusTotal Blog](https:\u002F\u002Fblog.virustotal.com\u002F2025\u002F10\u002Fvirustotal-success-stories-seqrite.html)\n- [Lynx Ransomware: Exposing How INC Ransomware Rebrands Itself](https:\u002F\u002Fpicussecurity.com\u002Fresource\u002Fblog\u002Flynx-ransomware)\n- [Abuse of alternative runtime environments Deno-tes defender headaches | SOPHOS](https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fblog\u002Fdeno-case-studies)\n- [Sinobi: The bougie-exclusive ransomware group that wants to be a ninja | Barracuda Networks Blog](https:\u002F\u002Fblog.barracuda.com\u002F2025\u002F11\u002F17\u002Fsinobi--the-bougie-exclusive-ransomware-group-that-wants-to-be-a)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Facronis-tru-details-inc-ransomware-evolution-with-800-victims-and-yara-rules.png?v=f32eebbecf",{"actors":18,"malware":39,"technologies":48},[19,24,29,33],{"url":20,"name":12,"slug":21,"type":10,"origin":22,"motivation":23},"\u002Fthreat-groups\u002Flynx","lynx",null,"financial",{"url":25,"name":26,"slug":27,"type":10,"origin":28,"motivation":23},"\u002Fthreat-groups\u002Fsinobi","Sinobi","sinobi","Russia \u002F Eastern Europe (suspected)",{"url":30,"name":31,"slug":32,"type":10,"origin":22,"motivation":23},"\u002Fthreat-groups\u002Finc-ransom","INC Ransom","inc-ransom",{"url":34,"name":35,"slug":35,"type":36,"origin":37,"motivation":38},"\u002Fthreat-groups\u002Fsalfetka","salfetka","unknown","Russia","Financial",[40,42,44,46],{"name":41},"Veeam-Get-Creds.ps1",{"name":43},"ProcessTerminator.exe",{"name":45},"Do",{"name":47},"Sinobi Ransomware",[49,52,53,55,57,60,63],{"vendor":50,"product":51},"Opera","Opera Air",{"vendor":50,"product":50},{"vendor":50,"product":54},"Opera GX",{"vendor":50,"product":56},"Opera Neon",{"vendor":58,"product":59},"Fortinet","EMS",{"vendor":61,"product":62},"Deno","Deno runtime",{"vendor":61,"product":61},"threat_actor_activity","2026-09-04T07:03:39.197374+00:00","2026-10-16T12:28:55.021221+00:00",{"articles":68},[69,79,90,102],{"slug":70,"title":71,"summary":72,"tags":73,"hero_image_url":77,"story_type":64,"created_at":78},"acronis-threat-research-unit-details-inc-ransomware-s-800-victim-run-with-full-a","Acronis Threat Research Unit details INC ransomware's 800+ victim run with full attack chain and YARA rules","Acronis Threat Research Unit publishes a detailed analysis of INC ransomware, tracing its evolution from an emerging RaaS operation to a top-tier group with 800+ victims since 2023, including the full attack chain, YARA rules, and IOCs.",[74,75,76,14,13],"INC Ransomware","CVE-2023-3519","Citrix NetScaler","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Facronis-threat-research-unit-details-inc-ransomware-s-800-victim-run-with-full-a.png?v=da1a5b3d25","2026-09-03T07:04:55.037913+00:00",{"slug":80,"title":81,"summary":82,"tags":83,"hero_image_url":88,"story_type":64,"created_at":89},"palo-alto-unit-42-405-ai-enabled-malware-samples-show-12-in-production","Palo Alto Unit 42: 405 AI-enabled malware samples show 12 in production","Palo Alto Networks Unit 42 analyzed 405 AI-enabled malware samples and found the space is dominated by PoC and researcher code, with only 12 samples hitting production endpoints across five distinct malware families.",[84,85,86,10,87],"AI malware","FunkSec","Palo Alto Unit 42","LLM","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fpalo-alto-unit-42-405-ai-enabled-malware-samples-show-12-in-production.png?v=efb3f6f578","2026-09-26T12:10:59.266452+00:00",{"slug":91,"title":92,"summary":93,"tags":94,"hero_image_url":100,"story_type":64,"created_at":101},"gen-digital-researchers-unveil-wordlistloader-and-synkloader-malware-loaders-for","Gen Digital Researchers Unveil WordlistLoader and SynkLoader Malware Loaders for ClickFix Infostealer Delivery","Gen Digital researchers identified two new malware loaders, WordlistLoader and SynkLoader, that deliver infostealers and phishing credentials through the ClickFix technique and are sold to ransomware affiliates.",[95,96,97,98,99,10],"Gen Digital","ClickFix","WordlistLoader","SynkLoader","infostealer","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fgen-digital-researchers-unveil-wordlistloader-and-synkloader-malware-loaders-for.png?v=ea5de72eef","2026-09-25T12:05:45.613962+00:00",{"slug":103,"title":104,"summary":105,"tags":106,"hero_image_url":112,"story_type":113,"created_at":114},"lockfile-ransomware-hijacks-windows-domains-via-petitpotam-ntlm-relay","LockFile Ransomware Hijacks Windows Domains via PetitPotam NTLM Relay","LockFile ransomware gang is leveraging the PetitPotam NTLM relay attack (CVE-2021-36942) to take over Windows domain controllers, with initial access gained through ProxyShell on Exchange servers.",[10,107,108,109,110,111],"PetitPotam","NTLM relay","ProxyShell","LockFile","CVE-2021-36942","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Flockfile-ransomware-hijacks-windows-domains-via-petitpotam-ntlm-relay.png?v=3ebd8c1c3f","ransomware_incident","2026-09-26T07:06:42.867972+00:00"]