INC Ransom and Lynx Ransomware Profile Guide: Shared Code, Targeting and Practical Defences

INC Ransom has hit hospitals, councils and schools with an intrusion playbook built on edge appliance flaws, valid accounts and ordinary admin tools, and its encryptor lives on under the Lynx name after the source code was offered for sale. This profile treats the two families together because the code evidence links them and the defences are the same. It draws on MITRE ATT&CK v20, Palo Alto Networks Unit 42, Group-IB, Secureworks and SentinelOne, plus public statements on the NHS Dumfries and Galloway and Leicester City Council incidents. It is written for security operations, identity and infrastructure teams, especially in healthcare and the public sector. Attribution follows each source's wording, and the page names no individuals and reproduces no leak-site material.

Key takeaways

• Two brands, one codebase. Unit 42 found 48 per cent of INC functions present in Lynx, and Group-IB measured more than 91 per cent overlapping functions between the two ESXi variants, so detections and playbooks for one apply to the other.
• Edge appliances opened the door. Sources record exploitation of Citrix NetScaler CVE-2023-3519 and CitrixBleed CVE-2023-4966, both in the CISA Known Exploited Vulnerabilities catalogue, alongside phishing and compromised valid accounts.
• The middle of the intrusion is administration in disguise. RDP with valid accounts, AdFind, Advanced IP Scanner, PsExec renamed to winupd, WMIC and AnyDesk carry the attack from foothold to mass deployment.
• Healthcare and public bodies are in scope despite Lynx's claims. Lynx says it avoids hospitals and government, but INC's documented victims include NHS Dumfries and Galloway and Leicester City Council, and ATT&CK lists healthcare and education among its most common sectors.
• Credential hygiene and backup isolation decide the outcome. MFA on every remote path, a tiered admin model, alerting on new services and remote copies, and backups that domain credentials cannot reach break most of the documented chain.

Who they are (names and aliases)

INC Ransom is a ransomware and data extortion operation that MITRE ATT&CK dates to at least July 2023. Unit 42 places the first INC samples, for both Windows and Linux, in August 2023, and reports that INC's source code was offered for sale on criminal forums from March 2024. Lynx was discovered in July 2024. Unit 42 describes Lynx as a repackaged INC codebase, and Group-IB says its comparison "strongly indicates" Lynx bought or adapted INC's source. Whether the same people run both is not established in the sources: treat Lynx as a successor or derivative brand, not a proven rebrand by the same operators.

For how these names fit the wider market, see the Ransomware Groups Guide and the Ransomware Family Lineage and Rebrands Guide.

Targeting and motivation

• Motivation: financial. ATT&CK maps INC's model to T1657 Financial Theft: data is stolen and encrypted, then the victim pays for decryption and for the data to stay private.
• Sectors: ATT&CK lists industrial, healthcare and education as the most common INC targets, in the US and Europe. Secureworks counted 72 leak-site victims between August 2023 and March 2024, with education at more than double the cross-group average and the UK second only to the US.
• Size: SentinelOne describes INC as hitting multiple industries with little discrimination and notes small and medium-sized organisations among victims.
• Lynx's stated rules: Group-IB's copy of the Lynx affiliate advert, posted on the RAMP forum from 8 August 2024, excludes healthcare, government, churches and children's charities, and excludes CIS countries, Ukraine, China, Iran and North Korea. Unit 42 saw Lynx victims in US and UK retail, real estate, architecture, financial and environmental services. Stated exclusions are marketing, not a control: do not lower defences because of them.
• Affiliate economics: Lynx offers affiliates an 80/20 split in their favour, a victim management panel and a paid calling service to pressure victims. See the Ransomware-as-a-Service Business Model Guide.

Tactics and techniques (MITRE ATT&CK)

IDs below are ATT&CK v20 relationships recorded against G1032 and S1139, plus Lynx behaviour from Unit 42 and Group-IB. Defence impairment now sits under tactic TA0112 Defense Impairment.

What Lynx adds

• Encryption: AES-128 in CTR mode with Curve25519 Donna. Group-IB lists fast (5 per cent), medium (15 per cent), slow (25 per cent) and entire (100 per cent) modes on Windows and Linux.
• File access: on Windows it enables SeTakeOwnershipPrivilege, rewrites file DACLs and uses the Restart Manager API to release locked files.
• Recovery inhibition: shadow copies are destroyed by setting the VSS maximum diff area size to 1 byte.
• Hypervisors: the ESXi build stops virtual machines by World ID, deletes snapshots with vim-cmd and can set the ransom note as the message of the day. See the ESXi Ransomware Playbook.

How they abuse identities and credentials

Every documented INC intrusion depends on identities: either stolen sessions at the edge or valid domain accounts inside. The encryptor is the last step; the account abuse is what makes it possible.

• Session tokens from the edge: CitrixBleed leaked valid NetScaler session cookies that let attackers skip passwords and MFA, which is why patching alone was not enough. The CitrixBleed 2023 breach shows the same flaw used against Boeing, ICBC and Xfinity. Revoke all active sessions after any appliance patch or compromise. See the Token and Session Security Guide.
• Valid accounts over RDP: ATT&CK records INC using compromised accounts to reach targets and RDP to move laterally. Any account with remote interactive logon to servers is a target.
• Hunting for domain admins: AdFind, Nltest and net commands enumerate privileged groups so the operators know which credentials to take next. Privileged accounts that log on to ordinary servers leave reusable credentials behind. See the Tiered Administration and Enterprise Access Model Guide.
• Backup credentials: SentinelOne lists a Veeam credential-dumping tool among INC's post-compromise tooling, and both families stop backup processes before encrypting. Backup service accounts that are domain-joined fall with the domain. See the Backup Identity Isolation Guide.
• Service accounts for deployment: mass deployment through PsExec and WMIC runs as LocalSystem or as a privileged account on hundreds of hosts at once. Service accounts with local admin rights everywhere make this trivial.

Notable incidents

Both UK public-sector cases follow the double extortion pattern: services recover from backups, but the leaked data keeps causing harm, because patients and residents become targets for follow-on fraud. Plan notification and support from day one. See the Ransomware Data Leak Site Listing Playbook and the Threat Actors Targeting Healthcare Guide.

Detection and defence

Detections that fit this playbook

Rollout order for defences

1. Close the edge first: inventory internet-facing VPN, Citrix and remote access appliances; patch KEV-listed flaws within your shortest service level; after each patch, terminate every active session and rotate appliance credentials.
2. Enforce phishing-resistant MFA on VPN, Citrix, RDP gateways and cloud consoles; pilot with IT staff, then expand. Keep a documented break-glass account. See the Phishing-Resistant MFA Guide.
3. Tier admin accounts: stop domain admins logging on to workstations and member servers; give helpdesk and server teams separate accounts.
4. Control admin tools: allowlist one remote access product, block PsExec and WMIC remote execution except from jump hosts, and run application control in audit mode for two to four weeks before enforcing. Roll back by returning the policy to audit. See the RMM Tool Security Guide.
5. Isolate backups: separate credentials, immutability, and a tested restore of a critical system each quarter, including ESXi hosts.
6. Exercise the scenario: run a tabletop that starts with a leak-site listing and patient data exposure, not just encryption.

Decision guidance

• Small organisations without a SOC: prioritise appliance patching, MFA and offline backups, and use a managed detection service for out-of-hours alerts, since deployment often happens overnight.
• Large estates: the biggest gain is the tiered admin model and blocking workstation-to-workstation SMB and RDP, because those stop the 500-host deployment pattern.
• Healthcare: clinical systems that cannot run EDR need network segmentation and strict jump-host access instead. See the Healthcare Identity Security Guide.

Metrics

• Edge exposure: days from KEV listing to patch on internet-facing appliances (target: inside your critical SLA).
• MFA coverage: percentage of remote access paths requiring phishing-resistant MFA.
• Admin hygiene: number of tier 0 accounts with logons to non-tier-0 hosts in the last 30 days (target: zero).
• Tool control: count of unapproved remote access or sync tools found on servers each month.
• Recovery: time to restore a critical system from isolated backup in the latest test.

Framework mapping

Practitioner checklist

• Confirm Citrix NetScaler and other edge appliances are patched for CVE-2023-3519, CVE-2023-4966 and later KEV entries, and that sessions were reset afterwards.
• Require phishing-resistant MFA on every external remote access path and block legacy authentication.
• Remove domain admin logons from workstations and member servers; review tier 0 group membership monthly.
• Alert on event 7045 service creation from remote sessions and on one binary copied to many hosts.
• Detect AdFind, Nltest bulk queries, NETSCAN and Advanced IP Scanner from user endpoints.
• Allowlist one remote access tool; block MegaSync, Rclone and unapproved AnyDesk on servers.
• Turn on Defender tamper protection and alert on any change to security tooling state.
• Keep backups immutable with credentials outside the domain, and test an ESXi host restore.
• Prepare a data leak response: notification, regulator contact (for example the ICO) and support for affected people.

Standards and references

• MITRE ATT&CK: INC Ransom (G1032)
• MITRE ATT&CK: INC Ransomware (S1139)
• CISA: Known Exploited Vulnerabilities Catalog
• NIST: Cybersecurity Framework 2.0
• Palo Alto Networks Unit 42: INC Ransomware Rebrand to Lynx
• Group-IB: Cat's Out of the Bag, Lynx Ransomware-as-a-Service
• Secureworks: GOLD IONIC Deploys INC Ransomware
• SentinelOne: INC Ransom

Related NHI Mgmt Group resources: Ransomware Groups Guide · Ransomware Response and Recovery Guide · Tiered Administration and Enterprise Access Model Guide · Threat Actors Targeting Healthcare Guide