{"id":57373,"date":"2024-10-11T23:00:14","date_gmt":"2024-10-11T23:00:14","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/inc-ransomware-rebrands-to-lynx-same-code-new-name-still-up-to-no-good\/"},"modified":"2024-10-11T23:00:14","modified_gmt":"2024-10-11T23:00:14","slug":"inc-ransomware-rebrands-to-lynx-same-code-new-name-still-up-to-no-good","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/inc-ransomware-rebrands-to-lynx-same-code-new-name-still-up-to-no-good\/","title":{"rendered":"INC ransomware rebrands to Lynx \u2013 same code, new name, still up to no good"},"content":{"rendered":"

Researchers at Palo Alto’s Unit 42 believe the INC ransomware crew is no more and recently rebranded itself as Lynx over a three-month period.<\/p>\n

INC was never a ransomware market leader, but since spinning up in October 2023 it made something of a name for itself with headline-grabbing attacks on the UK’s Leicester City Council and NHS Scotland, to name a few.<\/p>\n

Lynx, on the other hand, was first spotted in July 2024, and Unit 42’s researchers note that the number of detected Lynx samples has outpaced that of INC samples since then.<\/p>\n

\"Graph<\/a><\/p>\n

Graph depicting the number of ransomware sample detections of both Lynx and INC gangs over the previous 12 months, courtesy of Unit 42 \u2013 click to enlarge<\/p>\n<\/div>\n

After two months of Lynx being more prevalent than INC, detections of the latter fell to zero in September, although this alone doesn’t necessarily mean it’s gone for good. The same number of INC detections (zero) were also noted in January, February, and May, for example.<\/p>\n

However, code comparisons often provide better support for suspicions of rebranding and the same is true in this case. Running samples from both ransomware groups through BinDiff revealed a 70.8 percent match in shared functions.<\/p>\n