Glossary term
Ransomware
Ransomware is malware that encrypts files and systems so they become unusable until a ransom is paid.
Read more
Ransomware group profile
Lynx
Also known as Lynx ransomware, Lynx Group
Lynx is a ransomware group that the Cyber Security Agency of Singapore named on 16 August 2025 as one of at least eight groups using a tool that switches off endpoint security software.
- Active
In short
Lynx is a ransomware group that the Cyber Security Agency of Singapore named on 16 August 2025 as one of at least eight groups using a tool that switches off endpoint security software. Official material on Lynx is thin: we found no CISA or FBI advisory and no MITRE ATT&CK entry for it.
- StatusActiveas reported
- Other Names2names in public reportsLynx ransomware · Lynx Group
- Entry Routes2ways inNot stated for Lynx · Endpoint security switched off
- Techniques1mapped to MITRE ATT&CKData Encrypted for Impact
- Defences7first steps listedRestrict driver loading · Turn on tamper protection
Overview
Lynx is a ransomware group. The one official statement we could open that names it is a short advisory from the Cyber Security Agency of Singapore (CSA), dated 16 August 2025. It lists Lynx among at least eight ransomware groups that use a tool known as an EDR killer. EDR stands for endpoint detection and response, the security software on laptops and servers that spots attacks. This page keeps to what that advisory and other official pages say.
A note on sources: for Lynx the official material is very thin. MITRE ATT&CK has no Lynx group or software entry, and we found no CISA, FBI, Europol or other government advisory about Lynx itself. We do not use security company blogs. Questions that need more, such as who is behind Lynx, how many victims it has or how it gets in, are left unanswered here on purpose, because no official source we opened answers them.
What is Lynx ransomware?
Lynx is a ransomware group named in a government advisory. The CSA text does not describe Lynx’s own history, model or victims. It says only that there are reports of a new EDR killer in active use by at least eight ransomware groups: Blacksuit, RansomHub, Medusa, Qilin, Dragonforce, Crytox, Lynx and INC.
Is Lynx the same group as INC?
The CSA advisory lists Lynx and INC as two separate groups. MITRE ATT&CK describes INC Ransomware as a strain used by the INC Ransom group since at least 2023 and has no Lynx entry. Some non-official reporting discusses a possible link between the two. No government source we opened states one, so we do not.
What is the EDR killer Lynx uses?
CSA says it is believed to be an evolution of a tool called EDRKillShifter, developed by the RansomHub group. CSA says all the customized builds it describes were packed with a subscription packer service. It uses a technique known as bring your own vulnerable driver: it loads a real, signed but flawed driver that has deep access to the operating system, then uses it to find and stop security processes and services. The drivers get random five-character names and are often signed with stolen or expired certificates. CSA says the tool seems to come from a shared, collaborative framework, not a leak passed from one group to another. Once endpoint software is off, defenders are blind while the ransomware is deployed.
Are there recent attacks linked to Lynx?
We are not aware of any official statement that attributes a specific attack to Lynx, and we do not name victims. For current activity, check stopransomware.gov and your national cyber agency.
Who are the members of Lynx?
No official source we opened names any member, leader or location, so we do not guess. Treat any such claim without a government or court source with caution.
- 16 August 2025Singapore advisoryCSA names Lynx among at least eight ransomware groups using an EDR killer tool.
- Not foundJoint advisoryNo CISA or FBI #StopRansomware advisory about Lynx was found.
- Not foundMITRE ATT&CK entryATT&CK has no Lynx group or software page.
- Named in
- Cyber Security Agency of Singapore advisory, 16 August 2025
- Official statement
- One of at least eight groups using an EDR killer
- Tool lineage (CSA)
- Believed to be an evolution of RansomHub’s EDRKillShifter
- Technique
- Bring your own vulnerable driver
- MITRE ATT&CK entry
- None for Lynx; INC Ransomware is listed as S1139
- Government advisory about Lynx
- None found
Law enforcement action
The official sources opened for this page do not describe an arrest, takedown, sanction or indictment related to Lynx.
Also known as
- Lynx ransomware
- Lynx Group
How they get in
-
01
Not stated for Lynx
No official source we opened says how Lynx gets in. CISA's guide groups ransomware prevention by the usual routes: internet-facing flaws, stolen credentials and phishing.
-
02
Endpoint security switched off
CSA says Lynx is among groups using an EDR killer before ransomware is deployed. The tool loads a vulnerable signed driver to stop security software.
How they extort
Official sources opened for this page do not describe how Lynx extorts its victims.
Techniques
How to defend
-
Restrict driver loading
Block or restrict the loading of unsigned and untrusted drivers, and keep operating system, driver and security software updates current (CSA).
-
Turn on tamper protection
Enable tamper protection and use endpoint products that resist termination attempts (CSA).
-
Log outside the endpoint
Keep logging that does not depend on endpoint agents, so a disabled agent does not blind you (CSA).
-
Watch for security tools being stopped
Monitor for unusual process termination and attempts to disable logging, not only for known file signatures (CSA).
-
Limit administrator rights
Limit administrator privileges and enforce strict access controls based on least privilege (CSA).
-
Keep offline backups
Maintain offline, encrypted backups of critical data and test them. CISA says many ransomware variants try to delete or encrypt backups they can reach.
-
Use phishing-resistant MFA and close remote desktop
Use phishing-resistant multi-factor authentication for email, VPNs and critical accounts, and do not expose Remote Desktop on the internet (CISA).
Questions
What is Lynx ransomware?
Lynx is a ransomware group. The Cyber Security Agency of Singapore named it on 16 August 2025 as one of at least eight ransomware groups using a tool that disables endpoint detection and response software.
Is Lynx the same as INC ransomware?
The Singapore advisory lists Lynx and INC as separate groups, and MITRE ATT&CK has an entry for INC but none for Lynx. No government source we opened states a link between them.
Are there recent cyberattacks linked to the Lynx group?
We found no official statement attributing a specific attack to Lynx and we do not name victims. Check stopransomware.gov and your national cyber agency for current activity.
Who are the members of the Lynx group?
No official source we opened names any member or says where they are based, so this page does not either.
What is an EDR killer?
It is a tool that stops endpoint security software before ransomware runs. Singapore's agency says the one used by Lynx and seven other groups loads a vulnerable signed driver with deep system access to find and stop security processes.
How can I defend against Lynx?
Restrict driver loading, turn on tamper protection, keep logs outside the endpoint, limit administrator rights, keep offline backups and use phishing-resistant MFA. These come from the Singapore advisory and CISA's ransomware guide.
Sources
- Advisory on New Endpoint Detection and Response (EDR) Killer Tool Used by Multiple Ransomware Groups Cyber Security Agency of Singapore
- INC Ransomware, Software S1139 MITRE ATT&CK
- #StopRansomware Guide CISA
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.