Lynx Ransomware Deploys via Compromised RDP
A threat actor used stolen RDP credentials to move laterally, exfiltrate data via temp.sh, and deploy Lynx ransomware across backup and file servers over nine days.
The DFIR Report details an intrusion beginning with a valid, likely pre-compromised RDP login to an internet-exposed host, with no evidence of brute forcing—suggesting credentials sourced from an infostealer, breach reuse, or an initial access broker. The actor pivoted within ten minutes to a domain controller using separate domain admin credentials, created multiple look-alike privileged accounts for persistence, installed AnyDesk (though never used), and mapped virtualization and file-share infrastructure using SoftPerfect NetScan and later NetExec. Notably, both source IPs used throughout the intrusion were tied to Railnet LLC, identified by Intrinsec as bulletproof-hosting front for Virtualine, a Russia-based provider advertised on Exploit and XSS forums.
Over nine days, the actor returned intermittently to conduct further discovery, collect and 7-Zip sensitive files from network shares, and exfiltrate archives to the temporary file-sharing service temp.sh. On the final day, they accessed backup servers via RDP, deleted Veeam backup jobs to inhibit recovery, and deployed the Lynx ransomware binary (w.exe) across multiple backup and file servers with consistent command-line arguments. Total time-to-ransomware was approximately 178 hours.
The intrusion exemplifies a hands-on-keyboard RDP-centric operation with minimal malware footprint, relying almost entirely on valid credentials, living-off-the-land tools, and dual-use utilities (NetScan, NetExec, AnyDesk, 7-Zip) rather than custom implants, complicating detection until the ransomware deployment stage.
Mentioned in this report
Detection guidance
Archive Creation and Exfiltration to Temporary File-Sharing Service
7-Zip or similar archiving tool creating compressed files from network shares, followed by upload to temporary file-sharing domains, consistent with hands-on data theft prior to encryption. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Archive Creation and Exfiltration to Temporary File-Sharing Service
description: Detects 7-Zip or similar archiving utility creating compressed archives
from network-accessible paths (\\\\, /mnt), combined with network connections to
known temporary file-sharing domains. Generalises on archiver + temp-share pattern
without over-fitting to specific campaigns or filepaths.
tags:
- attack.exfiltration
- attack.t1567.002
logsource:
category: process_creation
product: windows
detection:
selection_archive:
Image|endswith:
- \7z.exe
- \7za.exe
- \rar.exe
CommandLine|contains:
- \\\\
- 'a '
selection_temp_upload:
CommandLine|contains:
- temp.sh
- 'curl '
- 'wget '
filter_admin_backup:
CommandLine|contains: backup.7z
condition: selection_archive or selection_temp_upload and not filter_admin_backup
falsepositives:
- Legitimate backup automation archiving network shares
- Administrative file transfer tools using temp services for internal purposes
level: medium
id: 8e32d4c4-7037-57a3-baa3-52409008d536
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://thedfirreport.com/2025/12/17/cats-got-your-files-lynx-ransomware
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free