Lynx Ransomware Deploys via Compromised RDP
A threat actor used stolen RDP credentials to move laterally, exfiltrate data via temp.sh, and deploy Lynx ransomware across backup and file servers over nine days.
Sourcethedfirreport.com — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
The DFIR Report details an intrusion beginning with a valid, likely pre-compromised RDP login to an internet-exposed host, with no evidence of brute forcing—suggesting credentials sourced from an infostealer, breach reuse, or an initial access broker. The actor pivoted within ten minutes to a domain controller using separate domain admin credentials, created multiple look-alike privileged accounts for persistence, installed AnyDesk (though never used), and mapped virtualization and file-share infrastructure using SoftPerfect NetScan and later NetExec. Notably, both source IPs used throughout the intrusion were tied to Railnet LLC, identified by Intrinsec as bulletproof-hosting front for Virtualine, a Russia-based provider advertised on Exploit and XSS forums.
Over nine days, the actor returned intermittently to conduct further discovery, collect and 7-Zip sensitive files from network shares, and exfiltrate archives to the temporary file-sharing service temp.sh. On the final day, they accessed backup servers via RDP, deleted Veeam backup jobs to inhibit recovery, and deployed the Lynx ransomware binary (w.exe) across multiple backup and file servers with consistent command-line arguments. Total time-to-ransomware was approximately 178 hours.
The intrusion exemplifies a hands-on-keyboard RDP-centric operation with minimal malware footprint, relying almost entirely on valid credentials, living-off-the-land tools, and dual-use utilities (NetScan, NetExec, AnyDesk, 7-Zip) rather than custom implants, complicating detection until the ransomware deployment stage.
Mentioned in this report
Detection guidance
Archive Creation and Exfiltration to Temporary File-Sharing Service
A behavioural hunt for the technique in general.
7-Zip or similar archiving tool creating compressed files from network shares, followed by upload to temporary file-sharing domains, consistent with hands-on data theft prior to encryption. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Archive Creation and Exfiltration to Temporary File-Sharing Service
description: Detects 7-Zip or similar archiving utility creating compressed archives
from network-accessible paths (\\\\, /mnt), combined with network connections to
known temporary file-sharing domains. Generalises on archiver + temp-share pattern
without over-fitting to specific campaigns or filepaths.
tags:
- attack.exfiltration
- attack.t1567.002
logsource:
category: process_creation
product: windows
detection:
selection_archive:
Image|endswith:
- \7z.exe
- \7za.exe
- \rar.exe
CommandLine|contains:
- \\\\
- 'a '
selection_temp_upload:
CommandLine|contains:
- temp.sh
- 'curl '
- 'wget '
filter_admin_backup:
CommandLine|contains: backup.7z
condition: selection_archive or selection_temp_upload and not filter_admin_backup
falsepositives:
- Legitimate backup automation archiving network shares
- Administrative file transfer tools using temp services for internal purposes
level: medium
id: 8e32d4c4-7037-57a3-baa3-52409008d536
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://thedfirreport.com/2025/12/17/cats-got-your-files-lynx-ransomware
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the actors and malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs