LYNX Ransomware Gang: 2 New Victims Posted on Leak Site — Campaign Analysis, KEV Exploitation Links & Detection Rules

Classification: TLP:CLEAR | Report Date: 2026-08-07 | Source: Live monitoring of LYNX .onion leak site via ransomware.live | Analyst: Security Arsenal — From The Dark Side Intel Hub

Executive Summary

Security Arsenal's dark web monitoring infrastructure has confirmed 2 new victim postings to the LYNX ransomware gang's data leak site within a 24-hour window (2026-08-06). Both victims — www.talbotdes.org (United Kingdom) and www.jerryleigh.com (United States) — fall outside traditional critical infrastructure sectors, consistent with LYNX's opportunistic, mid-market targeting doctrine. Correlation with the CISA Known Exploited Vulnerabilities catalog indicates LYNX's current access broker pipeline is heavily weighted toward edge security appliance exploitation (Check Point, Cisco FMC) and remote access tooling abuse (ConnectWise ScreenConnect). Organizations running unpatched perimeter gateways or unmanaged RMM tooling should treat this bulletin as an active-threat notification.

Threat Actor Profile — LYNX

Aliases / Attribution Overlap: LYNX operates its own branded leak site and negotiation portal. Intelligence community reporting has noted code and infrastructure lineage suggesting a rebrand/fork relationship with earlier RaaS families (INC RANSOM lineage is frequently cited), though LYNX presents itself as an independent operation.

Operating Model: LYNX functions as a Ransomware-as-a-Service (RaaS) platform, recruiting affiliates via underground forums with a claimed 80/20 affiliate-favorable revenue split. The group publicly markets an "ethical" targeting policy (claims to avoid healthcare and government), but leak site evidence repeatedly contradicts this — treat all such claims as disinformation.

Ransom Demands: Observed demands range from $250K to $5M USD, scaled to victim revenue. Mid-market victims in this campaign band typically see demands in the $300K–$900K range with 72-hour escalation timers before full data publication.

Initial Access Methods (observed across 2025–2026 campaigns):

• Exploitation of perimeter/VPN appliances (Check Point IKEv1 auth bypass — CVE-2026-50751 is a current favorite)
• Compromised RDP via brute force and credential-stuffing against internet-exposed 3389
• Phishing with macro-enabled Office documents and OneNote/ISO container lures
• Abuse of legitimate RMM tooling (ScreenConnect, AnyDesk) dropped post-access for persistence
• Supply chain / developer toolchain compromise (the Nx Console malicious package CVE-2026-48027 aligns with this vector)

Extortion Model: Double extortion — data is staged and exfiltrated (frequently via RClone to MEGA/Backblaze or attacker-controlled FTP) before encryption. Non-payers are published on the leak site with tiered data release.

Average Dwell Time: Estimated 4–11 days from initial access to detonation in mid-market intrusions, though access-broker-sourced intrusions can compress this to under 72 hours.

Current Campaign Analysis

Sector Targeting: Both victims fall into the "Other" classification — small-to-mid-sized commercial organizations without dedicated security operations. This matches LYNX's established pattern: they deliberately target organizations large enough to pay but too small to maintain 24/7 detection capability.

Geographic Concentration: United Kingdom and United States — the two highest-value English-speaking markets. GB/US concentration in LYNX postings has historically exceeded 60% of total victim volume, reflecting both affiliate language preferences and cyber-insurance payout likelihood in these jurisdictions.

Victim Profile:

Both organizations fit the classic LYNX victimology: single-site or lightly distributed businesses, likely flat network architecture, outsourced or minimal IT security staffing.

Posting Frequency / Escalation: Two same-day postings following a relative lull suggests a fresh batch of intrusions detonating simultaneously — a pattern consistent with a single initial access broker feeding LYNX affiliates, or exploitation of a newly weaponized CVE hitting unpatched estates in parallel. Expect follow-on postings within 7–14 days from the same access wave.

CVE Correlation — Likely Initial Access Vectors:

• CVE-2026-50751 (Check Point Security Gateway improper authentication, IKEv1) — highest-confidence vector. LYNX affiliates have favored perimeter auth bypasses since mid-2026; added to KEV 2026-06-08, giving a ~2-month weaponization window that aligns with current victim timing.
• CVE-2024-1708 (ConnectWise ScreenConnect path traversal → RCE) — persistent LYNX affiliate tooling. ScreenConnect is used both as an access vector and as post-compromise persistence disguised as legitimate IT tooling.
• CVE-2026-20131 (Cisco FMC deserialization) — edge management plane compromise enabling full firewall control and traffic manipulation.
• CVE-2023-21529 (Exchange deserialization) — leveraged for authenticated post-exploitation and mailbox-derived credential theft.
• CVE-2026-48027 (Nx Console embedded malicious code) — supply-chain foothold into developer workstations, providing a lateral path into build systems and domain credentials.

Assessment: Check Point and ScreenConnect exploitation are the primary suspects for this campaign wave. Any organization running these products unpatched should assume attempted compromise.

Detection Engineering

---
title: LYNX Ransomware - ScreenConnect and RMM Tool Persistence
id: 9f3a2b1e-lynx-2026-0001
status: experimental
description: Detects installation or execution of ConnectWise ScreenConnect and other RMM tooling commonly deployed by LYNX affiliates for persistence following CVE-2024-1708 exploitation or phishing-based initial access.
author: Security Arsenal Threat Intelligence
date: 2026/08/07
references:
    - https://securityarsenal.com/darkside
logsource:
    category: process_creation
    product: windows
 detection_placeholder: null
detection:
    selection_img:
        Image|endswith:
            - '\screenconnect.clientservice.exe'
            - '\screenconnect.windowsclient.exe'
            - '\anydesk.exe'
            - '\screenconnect.client.exe'
    selection_cmd:
        CommandLine|contains:
            - 'screenconnect'
            - 'instanceid='
    filter_known_rmm:
        CommandLine|contains:
            - 'your-company-rmm-instance'
    condition: (selection_img or selection_cmd) and not filter_known_rmm
falsepositives:
    - Legitimate IT-managed RMM deployments - baseline and allowlist your approved RMM instance IDs
level: high
tags:
    - attack.persistence
    - attack.t1219
---
title: LYNX Ransomware - Pre-Encryption Data Staging and Exfiltration via RClone
id: 9f3a2b1e-lynx-2026-0002
status: experimental
description: Detects RClone execution and compression staging behavior observed in LYNX double-extortion intrusions prior to ransomware detonation.
author: Security Arsenal Threat Intelligence
date: 2026/08/07
references:
    - https://securityarsenal.com/darkside
logsource:
    category: process_creation
    product: windows
detection:
    selection_rclone:
        - Image|endswith: '\rclone.exe'
        - OriginalFileName: 'rclone.exe'
        - CommandLine|contains:
            - 'rclone copy'
            - 'rclone sync'
            - 'rclone move'
    selection_targets:
        CommandLine|contains:
            - 'mega:'
            - 'b2:'
            - ':ftp:'
            - '--transfers'
            - 'remote:'
    selection_archive:
        Image|endswith:
            - '\7z.exe'
            - '\rar.exe'
            - '\winrar.exe'
        CommandLine|contains:
            - ' a -p'
            - ' -v2g'
            - ' -m5'
    condition: (selection_rclone and selection_targets) or selection_archive
falsepositives:
    - Legitimate backup jobs using RClone - scope exclusions to known backup service accounts and hosts
level: high
tags:
    - attack.exfiltration
    - attack.t1567.002
    - attack.t1560.001
---
title: LYNX Ransomware - Lateral Movement via PsExec and WMI Followed by Shadow Copy Deletion
id: 9f3a2b1e-lynx-2026-0003
status: experimental
description: Detects the LYNX pre-detonation sequence of PsExec/WMI remote execution followed by Volume Shadow Copy deletion, a high-fidelity indicator of imminent ransomware deployment.
author: Security Arsenal Threat Intelligence
date: 2026/08/07
references:
    - https://securityarsenal.com/darkside
logsource:
    category: process_creation
    product: windows
detection:
    selection_psexec:
        - Image|endswith:
            - '\psexec.exe'
            - '\psexesvc.exe'
            - '\paexec.exe'
        - CommandLine|contains:
            - '\\\\'
            - ' -accepteula'
    selection_wmi:
        ParentImage|endswith: '\wmiprvse.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\rundll32.exe'
    selection_vss:
        CommandLine|contains:
            - 'vssadmin delete shadows'
            - 'vssadmin resize shadowstorage'
            - 'wmic shadowcopy delete'
            - 'bcdedit'
            - 'recoveryenabled no'
            - 'wbadmin delete catalog'
    condition: 1 of selection_*
falsepositives:
    - Administrative PsExec usage by IT - correlate with account and source host before response
level: critical
tags:
    - attack.lateral_movement
    - attack.t1021.002
    - attack.t1047
    - attack.impact
    - attack.t1490

// LYNX Pre-Ransomware Staging Hunt - Microsoft Sentinel
// Hunts the 72-hour pre-detonation window: suspicious RMM execution,
// remote service creation (PsExec-style), archive staging, and shadow copy tampering.
// Recommended: run every 4 hours, alert on any host hitting 2+ signal categories.

let lookback = 72h;
let ApprovedRMM = dynamic(["yourcompany.screenconnect.com", "approved-rmm-instance-id"]);

let RMM_Signal = DeviceProcessEvents
| where Timestamp > ago(lookback)
| where FileName has_any ("screenconnect", "anydesk", "rclone", "7z.exe", "rar.exe")
   or ProcessCommandLine has_any ("rclone copy", "rclone sync", "mega:", "b2:")
| extend Signal = "RMM_Exfil_Tooling"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, Signal;

let Lateral_Signal = DeviceEvents
| where Timestamp > ago(lookback)
| where ActionType == "ServiceInstalled"
| extend ServiceName = tostring(parse_json(AdditionalFields).ServiceName)
| where ServiceName has_any ("PSEXESVC", "PAExec", "ScreenConnect")
| extend Signal = "Remote_Service_Install"
| project Timestamp, DeviceName, ServiceName, InitiatingProcessAccountName, Signal;

let VSS_Signal = DeviceProcessEvents
| where Timestamp > ago(lookback)
| where ProcessCommandLine has_any (
    "vssadmin delete shadows",
    "shadowcopy delete",
    "recoveryenabled no",
    "wbadmin delete catalog",
    "resize shadowstorage")
| extend Signal = "Shadow_Copy_Tampering"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, Signal;

union RMM_Signal, Lateral_Signal, VSS_Signal
| summarize Signals = make_set(Signal), SignalCount = dcount(Signal),
            FirstSeen = min(Timestamp), LastSeen = max(Timestamp)
         by DeviceName
| extend Severity = case(
    SignalCount >= 3, "CRITICAL - Probable active LYNX pre-detonation staging",
    SignalCount == 2, "HIGH - Correlate immediately",
    "MEDIUM - Investigate")
| order by SignalCount desc, LastSeen desc

# LYNX Rapid Triage Script - Run on suspected hosts and domain controllers
# Checks: new scheduled tasks (7d), RDP exposure, shadow copy integrity,
# recent RMM service installs, and suspicious admin logons.
# Usage: Run as Administrator. Output saved to C:\IR\lynx-triage-<hostname>-<date>.txt

$outDir = "C:\IR"
New-Item -ItemType Directory -Path $outDir -Force | Out-Null
$outFile = Join-Path $outDir ("lynx-triage-{0}-{1}.txt" -f $env:COMPUTERNAME, (Get-Date -Format 'yyyyMMdd-HHmm'))
$cutoff = (Get-Date).AddDays(-7)

function Write-Section($title) { "`n===== $title =====" | Tee-Object -FilePath $outFile -Append }

Write-Section "1. Scheduled Tasks Created/Modified in Last 7 Days (persistence check)"
Get-ScheduledTask | Where-Object {
    $_.Date -and ([datetime]$_.Date) -gt $cutoff -and $_.TaskPath -notlike "\Microsoft*"
} | Select-Object TaskName, TaskPath, Date, @{N='Action';E={$_.Actions.Execute}} |
  Format-Table -AutoSize | Out-String | Tee-Object -FilePath $outFile -Append

Write-Section "2. RDP Exposure & Recent RDP Logons (initial access check)"
$rdpEnabled = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server').fDenyTSConnections
"RDP Disabled flag (0 = RDP ENABLED): $rdpEnabled" | Tee-Object -FilePath $outFile -Append
$nla = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -ErrorAction SilentlyContinue).UserAuthentication
"NLA Enabled (1 = yes, REQUIRED): $nla" | Tee-Object -FilePath $outFile -Append
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; LogonType=10; StartTime=$cutoff} -MaxEvents 50 -ErrorAction SilentlyContinue |
  Select-Object TimeCreated, @{N='SourceIP';E={$_.Properties[18].Value}}, @{N='Account';E={$_.Properties[5].Value}} |
  Format-Table -AutoSize | Out-String | Tee-Object -FilePath $outFile -Append

Write-Section "3. Volume Shadow Copy Status (pre-detonation indicator)"
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) { "WARNING: NO shadow copies present - possible VSS deletion (T1490)" | Tee-Object -FilePath $outFile -Append }
else { $shadows | Select-Object InstallDate, DeviceObject | Format-Table -AutoSize | Out-String | Tee-Object -FilePath $outFile -Append }
vssadmin list shadows 2>&1 | Out-String | Tee-Object -FilePath $outFile -Append

Write-Section "4. Recently Installed Services - RMM/PsExec Persistence (T1219 / T1543)"
Get-CimInstance Win32_Service | Where-Object {
    $_.PathName -match 'screenconnect|anydesk|psexec|paexec|rclone|splashtop|teamviewer'
} | Select-Object Name, DisplayName, State, StartMode, PathName |
  Format-List | Out-String | Tee-Object -FilePath $outFile -Append

Write-Section "5. Suspicious New Local Admin Accounts (7d)"
Get-LocalGroupMember -Group 'Administrators' -ErrorAction SilentlyContinue | ForEach-Object {
    $u = Get-LocalUser -Name $_.Name.Split('\')[-1] -ErrorAction SilentlyContinue
    if ($u -and $u.PasswordLastSet -gt $cutoff) {
        "NEW/CHANGED ADMIN: $($u.Name) | PasswordSet: $($u.PasswordLastSet) | Enabled: $($u.Enabled)" | Tee-Object -FilePath $outFile -Append
    }
}

Write-Section "6. Edge Device Firmware Reminder"
"Verify Check Point gateway patched for CVE-2026-50751 and Cisco FMC patched for CVE-2026-20131 - cannot be checked from endpoint." | Tee-Object -FilePath $outFile -Append

"`nTriage complete: $outFile" 

Incident Response Priorities

T-Minus Detection Checklist (Before Encryption Fires)

1. New or unexpected RMM binaries (ScreenConnect, AnyDesk) on servers or workstations not deployed by IT — LYNX's persistence signature.
2. Service installs named PSEXESVC or similar across multiple hosts within a short window — mass lateral movement preceding deployment.
3. Large outbound transfers to MEGA, Backblaze B2, or unfamiliar FTP endpoints, especially from file servers or domain-joined backup hosts.
4. Bulk archive creation (7z/RAR with password flags, -v2g volume splitting) in user or shared directories.
5. VSS deletion or shadowstorage resize commands — if you see this, detonation is likely minutes to hours away; isolate immediately.
6. Exchange exploitation artifacts (CVE-2023-21529): suspicious serialized payload executions under w3wp.exe / UMWorkerProcess.exe.

Assets LYNX Historically Prioritizes for Exfiltration

• Finance and HR shares (payroll, banking details, PII) — maximum extortion leverage
• Legal contracts and insurance documentation (used to calibrate ransom to policy limits)
• Customer databases and email archives
• Backup repositories (targeted for destruction before encryption to eliminate recovery options)

Containment Actions (Ordered by Urgency)

1. Isolate affected hosts at the switch/EDR level — do not wait for full scoping if VSS tampering is observed.
2. Disable compromised accounts and force credential resets for all accounts observed in lateral movement telemetry, starting with Domain Admins and service accounts.
3. Block egress to known exfil destinations (MEGA, B2, attacker IPs) at the perimeter — cutting exfil mid-transfer degrades their extortion leverage.
4. Take perimeter devices offline from management interfaces — if Check Point/Cisco FMC compromise is suspected, rotate all credentials stored on or transiting those devices.
5. Preserve forensic images of initial-access hosts before remediation; volatile data first.
6. Engage IR retainers and legal counsel before any attacker communication; document all decisions for insurance and regulatory purposes.

Hardening Recommendations

Immediate (24 Hours)

• Patch or mitigate CVE-2026-50751 (Check Point) and CVE-2026-20131 (Cisco FMC) — if patching is impossible, disable IKEv1 and restrict management interfaces to a dedicated, jump-host-only VLAN.
• Patch ConnectWise ScreenConnect (CVE-2024-1708) or remove it entirely; audit for unauthorized ScreenConnect instances across the estate using the triage script above.
• Enforce NLA + MFA on all RDP, and eliminate internet-exposed 3389 — place RDP behind VPN/ZTNA with device compliance checks.
• Deploy the Sigma rules above to your SIEM and enable the Sentinel hunt query on a 4-hour schedule.
• Block RClone/7z/RAR execution for non-admin users via AppLocker/WDAC, or at minimum alert on execution.
• Verify backup immutability and test one restore today — LYNX destroys backups before detonating.

Short-Term (2 Weeks)

• Network segmentation: isolate backup infrastructure, management planes, and server VLANs from general workstation traffic; LYNX's speed depends on flat networks.
• Deploy application control and RMM allowlisting — any remote access tool not on the approved list should be blocked and alerted.
• EGRESS filtering with TLS inspection on cloud storage categories not business-approved (MEGA, personal OneDrive, anon file hosts).
• Exchange hardening: apply all cumulative updates addressing CVE-2023-21529, enable AMSI integration, and restrict EWS/OWA to required users.
• Developer toolchain audit given CVE-2026-48027: pin package versions, verify package integrity signatures, and scan build agents for the malicious Nx Console package.
• Implement a deception layer (canary files/credentials on file shares) — LYNX's staging phase trips these reliably before detonation.
• Run a purple-team exercise replaying this exact TTP chain: VPN exploit → ScreenConnect persistence → WMI lateral movement → RClone exfil → VSS deletion.

This briefing is based on live dark web leak site monitoring. Victim postings reflect attacker claims and do not confirm the scope of compromise. Security Arsenal continues to monitor LYNX infrastructure and will update this bulletin as new postings appear.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub