[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/ "High Profile Threats") * [Ransomware](https://unit42.paloaltonetworks.com/category/ransomware/ "Ransomware") [Ransomware](https://unit42.paloaltonetworks.com/category/ransomware/) # Lynx Ransomware: A Rebranding of INC Ransomware ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 8 min read Related Products [![Advanced WildFire icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced WildFire](https://unit42.paloaltonetworks.com/product-category/advanced-wildfire/ "Advanced WildFire")[![Cloud-Delivered Security Services icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Cloud-Delivered Security Services](https://unit42.paloaltonetworks.com/product-category/cloud-delivered-security-services/ "Cloud-Delivered Security Services") * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Pranay Kumar Chhaparwal](https://unit42.paloaltonetworks.com/author/pranay-kumar-chhaparwal/) * [Micah Yates](https://unit42.paloaltonetworks.com/author/micah-yates/) * [Benjamin Chang](https://unit42.paloaltonetworks.com/author/benjamin-chang/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:October 10, 2024 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) * [Ransomware](https://unit42.paloaltonetworks.com/category/ransomware/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [Double extortion](https://unit42.paloaltonetworks.com/tag/double-extortion/) * [INC ransomware](https://unit42.paloaltonetworks.com/tag/inc-ransomware/) * [Leak site](https://unit42.paloaltonetworks.com/tag/leak-site/) * [Lynx ransomware](https://unit42.paloaltonetworks.com/tag/lynx-ransomware/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/inc-ransomware-rebrand-to-lynx/?pdf=download&lg=en&_wpnonce=40dbae5d0f "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/inc-ransomware-rebrand-to-lynx/?pdf=print&lg=en&_wpnonce=40dbae5d0f "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=Lynx%20Ransomware:%20A%20Rebranding%20of%20INC%20Ransomware&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Finc-ransomware-rebrand-to-lynx%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Finc-ransomware-rebrand-to-lynx%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Finc-ransomware-rebrand-to-lynx%2F&title=Lynx%20Ransomware:%20A%20Rebranding%20of%20INC%20Ransomware "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Finc-ransomware-rebrand-to-lynx%2F&text=Lynx%20Ransomware:%20A%20Rebranding%20of%20INC%20Ransomware "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Finc-ransomware-rebrand-to-lynx%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=Lynx%20Ransomware:%20A%20Rebranding%20of%20INC%20Ransomware%20https%3A%2F%2Funit42.paloaltonetworks.com%2Finc-ransomware-rebrand-to-lynx%2F "Share in Mastodon") ## **Executive Summary** In July 2024, researchers from Palo Alto Networks discovered a successor to INC ransomware named Lynx. Since its emergence, the group behind this ransomware has actively targeted organizations in various sectors such as retail, real estate, architecture, and financial and environmental services in the U.S. and UK. Lynx ransomware shares a significant portion of its source code with INC ransomware. INC ransomware initially surfaced in August 2023 and had variants compatible with both Windows and Linux. While we haven't confirmed any Linux samples yet for Lynx ransomware, we have noted Windows samples. This ransomware operates using a ransomware-as-a-service (RaaS) model. This article delves into the timeline of these more recent attacks and the evolving tactics employed by the threat actor behind this ransomware. Palo Alto Networks customers are better protected from Lynx ransomware through our [Network Security](https://www.paloaltonetworks.com/network-security) solutions and [Cortex](https://www.paloaltonetworks.com/cortex) line of products. If you think you might have been compromised or have an urgent matter, contact the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html). | **Related Unit 42 Topics** | [**Ransomware**](https://unit42.paloaltonetworks.com/category/ransomware/), **[Double Extortion](https://unit42.paloaltonetworks.com/tag/double-extortion/)** | |----------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------| ## **Activity Timeline** Figure 1 below shows a timeline comparing the number of confirmed samples we have discovered for both INC and Lynx ransomware. This graph presents a comparison of the sample count for both INC and Lynx ransomware on a monthly basis from October 2023 through September 2024. :chart: Figure 1. INC versus Lynx ransomware sample timeline. The source code for INC ransomware [was available for sale on the criminal underground market as early as March 2024](https://www.bleepingcomputer.com/news/security/inc-ransomware-source-code-selling-on-hacking-forums-for-300-000/). Because of this, we expect many malware authors to acquire and repackage this code to develop new ransomware, similar to what the Lynx group did. As a result, we can expect a growing trend in which newer or different ransomware groups reuse this existing code. ## **Delivery Mechanism** The group behind Lynx ransomware represents an increasingly prevalent and sophisticated double-extortion threat. The threat operators commonly disseminate their ransomware through a variety of cyberattack vectors. These vectors include: * Phishing emails that deceive users into revealing sensitive information * Malicious downloads that surreptitiously install the ransomware onto victims' systems * Hacking forums where cybercriminals share information and resources The double extortion aspect of Lynx ransomware means that it exfiltrates a victim's data before encrypting it. This not only encrypts the victim's data, rendering it inaccessible, but also allows the ransomware group to leak or sell this information if the victim does not make a ransom payment. Like other ransomware groups, this multifaceted approach to cyberextortion has made Lynx ransomware a formidable threat to individuals and organizations alike. This necessitates organizations to develop robust cybersecurity measures to counteract its impact. ## **Data Leak Site** The group asserts that it has breached data from numerous companies and has publicly displayed the pilfered information on its website at http\[:\]//lynxblog\[.\]net as demonstrated in Figures 2 and 3. ![Screenshot of the Lynx Leaks web interface displaying various reports. Each report is presented with titles, publication dates, descriptions, viewer counts, and a 'Go to the publication' button. The background is dark with the text and buttons highlighted in blue tones.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/10/word-image-968766-137046-2.jpeg) Figure 2. Leaked data published on the Lynx ransomware website. ![A blurred screenshot of the Lynx leak site interface displaying several navigation options like News and Reports. The main panel shows obscured text fields and image thumbnails, indicating a focus on media or publications. The interface theme is dark with hints of blue highlights.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/10/word-image-971789-137046-3.jpeg) Figure 3. Leaked data with total income, date and size of data. The group has a strict policy and recently released a statement on their activities as shown in Figure 4. This group states it is financially motivated, but it claims it does not target government institutes, hospitals or non-profit organizations. ![Press release from Lynx ransomeware on July 24, 2024, discussing their approach to avoid harm to organizations by incentivizing ethical considerations and fostering dialogue for better economic and social outcomes.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/10/word-image-975051-137046-4.png) Figure 4. Leaked data published on the Lynx ransomware website. This group has also created a reporting page for its operations as shown in Figure 5. ![A screenshot of a digital 'Report' form with fields to enter a name, email, and a description. Below these, there is a captcha asking to solve a mathematical addition problem. A 'Send' button is provided at the bottom.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/10/word-image-979022-137046-5.png) Figure 5. Reporting form on the Lynx ransomware website. Below, Figure 6 highlights the logo used for Lynx ransomware as seen on its website. ![Logo of Lynx featuring a stylized shield with a lynx head silhouette in white on a black background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/10/word-image-982058-137046-6.png) Figure 6. Lynx ransomware logo used on its website. ## **Technical Analysis of Lynx Ransomware** The Lynx ransomware samples we analyzed used AES-128 in CTR mode and Curve25519 Donna encryption algorithms. All files are encrypted and have the .lynx extension appended to them. This malware version is designed for the Windows platform and is written in the C++ programming language. Attackers can tailor their execution of Lynx ransomware by using arguments supplied during runtime as illustrated in Figure 7. ![Command prompt screen displaying a list of arguments. The arguments include options for file encryption, verbose output, encryption of network shares, and others. Some identifying information is redacted.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/10/word-image-984682-137046-7.png) Figure 7. Command-line options present in the malware. The ransomware's features include the following: * Designating specific directories/files for encryption * Terminating services/processes * Encrypting network drives * Mounting concealed disks * Enabling or disabling background image alterations * Printing all console logs Figure 8 shows code snippets for various arguments available for Lynx ransomware. It can even load hidden drives and encrypt network share drives. ![Screenshot of computer code in an IDE, featuring multiple lines of code with functions involving encryption, verbosity, and process management.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/10/word-image-988253-137046-8.png) Figure 8. Encryption mode in the malware. If no arguments are given, the ransomware defaults to encrypting all files and drives on the system. Additionally, it deletes shadow copies and backup partition drives as shown in Figure 9. ![A screenshot of a computer screen displaying a command prompt window with various system processes being executed, including stopping processes, initializing threads, and encrypting files. The window shows several file paths and status messages related to system security. Some identifying information in the first line is redacted.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/10/word-image-991618-137046-9.png) Figure 9. Running a Lynx ransomware sample with default arguments in a command terminal. As noted from the debugger results in Figure 10, the ransomware scans all the drives, attempts to mount them, then encrypts the data they contain. ![A screenshot of a computer screen displaying assembly language code with various memory addresses and operations.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/10/word-image-994270-137046-10.png) Figure 10. Lynx ransomware sample checking for drive letters. Before starting the encryption process, the sample would kill the processes on the system listed in Figure 11 below. ![A screenshot showing a section of computer code with various data offsets listed, such as Backup, Exchange, Java, and Notepad. One line is highlighted in purple with the word "Veeam" on the right side.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/10/word-image-997656-137046-11.png) Figure 11. Lynx checking for various processes in the system. Figure 12 shows code snippets illustrating this process. ![A screenshot of computer code in an Integrated Development Environment (IDE) debugger environment with highlighted syntax in various colors, predominantly green and purple, indicating different elements like text, data, and operations.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/10/word-image-779-137046-12.png) Figure 12. Code snippets checking process and termination. Like many other ransomware strains, Lynx ransomware uses the [Restart Manager](https://learn.microsoft.com/en-us/windows/win32/rstmgr/restart-manager-portal) API RstrtMgr to enhance its encryption capabilities and maximize its impact on the victim's system. By incorporating RstrtMgr into its attack process, Lynx ransomware can target files that are currently in use or locked by other applications. RstrtMgr helps the ransomware identify which applications are using the desired files. Ransomware such as Conti, Cactus and BiBi Wiper have also been observed employing this technique. After the ransomware encrypts all files, it attempts to print a report via [Microsoft OneNote](https://www.onenote.com/?public=1&wdorigin=ondcauth2&wdorigin=ondc) as shown in the debugger output in Figure 13 and the command-line output in Figure 14. ![A screenshot of a computer screen displaying code in an editor. The left side shows lines of hexadecimal values and assembly language, while the right side includes a text annotation. Red arrows point to two specific lines at the top and in the middle of the screenshot.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/10/word-image-4051-137046-13.png) Figure 13. Debugger output showing a Lynx ransomware sample sending notes to OneNote. ![Computer screen displaying multiple lines of text that indicate the process of sending notes to various versions of OneNote, including OneNote 2013, OneNote 2010, and OneNote for Windows 10. The text also includes messages about the successful closure of the same. These are highlighted inside a red box. Some identifying information is redacted.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/10/word-image-8872-137046-14.png) Figure 14. After running Lynx ransomware from the command line, the output revealed it sent notes to OneNote on completion of encryption. Figure 15 below shows that the ransomware appends a .lynx extension to all encrypted file names. ![A computer desktop screen displaying an open folder named "Documents" with various files and folders listed, including "Custom Office Templates" and several Excel files. Icons for applications like Firefox, Google Chrome, and Microsoft Edge are visible on the taskbar. The desktop background has text saying that the computer's data is stolen and encrypted and there is contact information for Lynx.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/10/word-image-13574-137046-15.jpeg) Figure 15. Desktop from a Lynx ransomware infection with the .lynx file extension appended to encrypted files. The presence of a program database (PDB) path with Lynx in the name confirms the ransomware as a Lynx variant, as shown in the output of a packed executable (PE) analyzer tool in Figure 16. ![Screenshot displaying file paths related to "Lynx Release" on a computer, with text highlighted in light blue on a dark blue background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/10/word-image-16711-137046-16.png) Figure 16. Lynx sample .pdb path. Lynx additionally drops a README.txt file as a ransom note. Figure 17 displays both the Base64-encoded content found in the sample data section of [a Lynx ransomware sample](https://www.virustotal.com/gui/file/eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc) and the decoded ransom note. ![Screenshot of a Lynx ransomware sample code in a text editor, with highlighted areas showing Base64 text and its translation to ASCII text used for a ransom note.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/10/word-image-19264-137046-17.jpeg) Figure 17. Ransom note Base64-encoded text from the Lynx ransomware sample and the decoded ransom note. Figure 18 below shows a different ransom note from [another Lynx ransomware sample](https://www.virustotal.com/gui/file/571f5de9dd0d509ed7e5242b9b7473c2b2cbb36ba64d38b32122a0a337d6cf8b). ![A screenshot of a text file named "README.txt" open in Notepad, displaying a list of Tor network mirror links for downloading a software. The file interface includes tabs for File, Edit, Format, View, and Help.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/10/word-image-23244-137046-18.jpeg) Figure 18. Ransom note from another Lynx ransomware sample. ## **Comparison With INC Ransomware** We used the open-source tool [BinDiff](https://github.com/google/bindiff) to compare the code between a sample of Lynx ransomware and a sample of INC ransomware. Figure 19 shows the BinDiff results from the INC sample in the Primary Call Graph (bottom right) and the Lynx sample in the Secondary Call Graph (bottom left). By analyzing and cross-referencing the call graphs of both ransomware samples, we can observe the extent to which their code structures and functionalities overlap and diverge. ![This image contains a series of graphs and charts displaying comparative data analysis between two code sets. It features pie charts illustrating categories such as Functions, Calls, Basic Blocks, and Jumps, a histogram showing Similarity percentage, and tables detailing specific metrics like function counts, calls, instructions, and more. The color coding and visual elements like percentages help to compare and contrast the data between the two sets effectively.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/10/word-image-27051-137046-19.png) Figure 19. Code similarity between INC and Lynx ransomware as shown by [BinDiff](https://www.zynamics.com/bindiff.html). Upon close examination, we find that the overall matched functions between both ransomware samples stand at 48%. This indicates that nearly half of the functions present in the INC ransomware sample are also used in the Lynx sample. The percentage of matched functions rises to an impressive 70.8% when we consider functions that are common to both ransomware families. This significant overlap in shared functions strongly suggests that the developers of Lynx ransomware have borrowed and repurposed a considerable portion of the INC codebase to create their own malicious software. Reusing code between different ransomware families is common among cybercriminals. By leveraging preexisting code and building upon the foundations laid by other successful ransomware, threat actors can save time and resources in the development of their own attacks. This can ultimately lead to more successful and widespread campaigns. ## **Conclusion** Lynx ransomware use is active and evolving, yet attackers often employ similar code patterns in newer versions. Palo Alto Networks monitors such campaigns and uses various static and dynamic methods for detecting and blocking them. Ransomware is a familiar presence in the threat landscape, and there are numerous approaches to protecting customers from these evolving attacks. These methods include dynamic and behavioral detections, as well as more reactive [signature or pattern](https://www.paloaltonetworks.com/cyberpedia/what-is-a-payload-based-signature)-based solutions. ### **Palo Alto Networks Protection and Mitigation** Palo Alto Networks customers are better protected from Lynx ransomware through the following products: * The [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) Anti-Ransomware module protects against the threats described in both versions of the malware: Windows and Linux. * [Advanced WildFire](https://docs.paloaltonetworks.com/wildfire): The Advanced WildFire machine-learning models and analysis techniques have been reviewed and updated in light of the IoCs shared in this research. If you think you may have been compromised or have an urgent matter, get in touch with the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html) or call: * North America Toll-Free: 866.486.4842 (866.4.UNIT42) * EMEA: +31.20.299.3130 * APAC: +65.6983.8730 * Japan: +81.50.1790.0200 Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the [Cyber Threat Alliance](https://www.cyberthreatalliance.org). ## **Indicators of Compromise** SHA256 hashes of Windows EXE samples for Lynx ransomware: * 571f5de9dd0d509ed7e5242b9b7473c2b2cbb36ba64d38b32122a0a337d6cf8b * 82eb1910488657c78bef6879908526a2a2c6c31ab2f0517fcc5f3f6aa588b513 * eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc SHA256 hashes of Windows EXE samples for INC ransomware: * 02472036db9ec498ae565b344f099263f3218ecb785282150e8565d5cac92461 * 05e4f234a0f177949f375a56b1a875c9ca3d2bee97a2cb73fc2708914416c5a9 * 11cfd8e84704194ff9c56780858e9bbb9e82ff1b958149d74c43969d06ea10bd * 1754c9973bac8260412e5ec34bf5156f5bb157aa797f95ff4fc905439b74357a * 1a7c754ae1933338c740c807ec3dcf5e18e438356990761fdc2e75a2685ebf4a * 29a25e971dbb87d3adcee75693782d978a3ca9f64df0a59b015ca519a4026c49 * 3156ee399296d55e56788b487701eb07fd5c49db04f80f5ab3dc5c4e3c071be0 * 36e3c83e50a19ad1048dab7814f3922631990578aab0790401bc67dbcc90a72e * 508a644d552f237615d1504aa1628566fe0e752a5bc0c882fa72b3155c322cef * 64b249eb3ab5993e7bcf5c0130e5f31cbd79dabdcad97268042780726e68533f * 7f104a3dfda3a7fbdd9b910d00b0169328c5d2facc10dc17b4378612ffa82d51 * 869d6ae8c0568e40086fd817766a503bfe130c805748e7880704985890aca947 * 9ac550187c7c27a52c80e1c61def1d3d5e6dbae0e4eaeacf1a493908ffd3ec7d * ca9d2440850b730ba03b3a4f410760961d15eb87e55ec502908d2546cd6f598c * d147b202e98ce73802d7501366a036ea8993c4c06cdfc6921899efdd22d159c6 * e17c601551dfded76ab99a233957c5c4acf0229b46cd7fc2175ead7fe1e3d261 * ee1d8ac9fef147f0751000c38ca5d72feceeaae803049a2cd49dcce15223b720 * f96ecd567d9a05a6adb33f07880eebf1d6a8709512302e363377065ca8f98f56 * fcefe50ed02c8d315272a94f860451bfd3d86fa6ffac215e69dfa26a7a5deced * fef674fce37d5de43a4d36e86b2c0851d738f110a0d48bae4b2dab4c6a2c373e SHA256 hashes of Linux ELF samples for INC ransomware: * 63e0d4e861048f581c9e5c64b28a053eb0023d58eebf2b943868d5f68a67a8b7 * a0ceb258924ef004fa4efeef4bc0a86012afdb858e855ed14f1bbd31ca2e42f5 * c41ab33986921c812c51e7a86bd3fd0691f5bba925fae612f1b717afaa2fe0ef Contact email address from Lynx ransomware note: * martina.lestariid1898@proton\[.\]me Publicly accessible leak site blog for Lynx ransomware: * lynxblog\[.\]net Tor URLs for Lynx ransomware: * http\[:\]//lynxbllrfr5262yvbgtqoyq76s7mpztcqkv6tjjxgpilpma7nyoeohyd\[.\]onion * http\[:\]//lynxbllrfr5262yvbgtqoyq76s7mpztcqkv6tjjxgpilpma7nyoeohyd\[.\]onion/disclosures * http\[:\]//lynxblogco7r37jt7p5wrmfxzqze7ghxw6rihzkqc455qluacwotciyd\[.\]onion * http\[:\]//lynxblogijy4jfoblgix2klxmkbgee4leoeuge7qt4fpfkj4zbi2sjyd\[.\]onion * http\[:\]//lynxblogmx3rbiwg3rpj4nds25hjsnrwkpxt5gaznetfikz4gz2csyad\[.\]onion * http\[:\]//lynxblogoxllth4b46cfwlop5pfj4s7dyv37yuy7qn2ftan6gd72hsad\[.\]onion * http\[:\]//lynxblogtwatfsrwj3oatpejwxk5bngqcd5f7s26iskagfu7ouaomjad\[.\]onion * http\[:\]//lynxblogxstgzsarfyk2pvhdv45igghb4zmthnzmsipzeoduruz3xwqd\[.\]onion * http\[:\]//lynxblogxutufossaeawlij3j3uikaloll5ko6grzhkwdclrjngrfoid\[.\]onion * http\[:\]//lynxch2k5xi35j7hlbmwl7d6u2oz4vp2wqp6qkwol624cod3d6iqiyqd\[.\]onion/login * http\[:\]//lynxchatbykq2vycvyrtjqb3yuj4ze2wvdubzr2u6b632trwvdbsgmyd\[.\]onion/login * http\[:\]//lynxchatde4spv5x6xlwxf47jdo7wtwwgikdoeroxamphu3e7xx5doqd\[.\]onion/login * http\[:\]//lynxchatdy3tgcuijsqofhssopcepirjfq2f4pvb5qd4un4dhqyxswqd\[.\]onion/login * http\[:\]//lynxchatdykpoelffqlvcbtry6o7gxk3rs2aiagh7ddz5yfttd6quxqd\[.\]onion/login * http\[:\]//lynxchatfw4rgsclp4567i4llkqjr2kltaumwwobxdik3qa2oorrknad\[.\]onion/login * http\[:\]//lynxchatly4zludmhmi75jrwhycnoqvkxb4prohxmyzf4euf5gjxroad\[.\]onion/login * http\[:\]//lynxchatohmppv6au67lloc2vs6chy7nya7dsu2hhs55mcjxp2joglad\[.\]onion/login ## **Additional References** * [INC ransomware source code selling on hacking forums for $300,000](https://www.bleepingcomputer.com/news/security/inc-ransomware-source-code-selling-on-hacking-forums-for-300-000/) -- Bleeping Computer * [INC Linux Ransomware - Sandboxing with ELFEN and Analysis](https://nikhilh-20.github.io/blog/inc_ransomware/) -- M\&M: Malware and Musings by Nikhil "Kaido" Hegde Back to top ### Tags * [Double extortion](https://unit42.paloaltonetworks.com/tag/double-extortion/ "double extortion") * [INC ransomware](https://unit42.paloaltonetworks.com/tag/inc-ransomware/ "INC ransomware") * [Leak site](https://unit42.paloaltonetworks.com/tag/leak-site/ "Leak site") * [Lynx ransomware](https://unit42.paloaltonetworks.com/tag/lynx-ransomware/ "Lynx ransomware") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Contagious Interview: DPRK Threat Actors Lure Tech Industry Job Seekers to Install New Variants of BeaverTail and InvisibleFerret Malware](https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/ "Contagious Interview: DPRK Threat Actors Lure Tech Industry Job Seekers to Install New Variants of BeaverTail and InvisibleFerret Malware") ### Table of Contents * ### Related Articles * [The Golden Scale: 'Tis the Season for Unwanted Gifts](https://unit42.paloaltonetworks.com/new-shinysp1d3r-ransomware/ "article - table of contents") * [The Golden Scale: Notable Threat Updates and Looking Ahead](https://unit42.paloaltonetworks.com/scattered-lapsus-hunters-updates/ "article - table of contents") * [Extortion and Ransomware Trends January-March 2025](https://unit42.paloaltonetworks.com/2025-ransomware-extortion-trends/ "article - table of contents") ## Related Ransomware Resources ![Pictorial representation of Iran cyber attacks. Close-up of a person wearing glasses, with computer code reflected in the lenses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/12_Security-Technology_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) April 17, 2026 [#### Threat Brief: Escalation of Cyber Risk Related to Iran (Updated April 17)](https://unit42.paloaltonetworks.com/iranian-cyberattacks-2026/) * [APK](https://unit42.paloaltonetworks.com/tag/apk/ "APK") * [DDoS attacks](https://unit42.paloaltonetworks.com/tag/ddos-attacks/ "DDoS attacks") * [GenAI](https://unit42.paloaltonetworks.com/tag/genai/ "GenAI") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/iranian-cyberattacks-2026/ "Threat Brief: Escalation of Cyber Risk Related to Iran (Updated April 17)") ![Pictorial representation of RaaS RansomHouse. Digital representation of cybersecurity concept with a padlock superimposed over computer circuit boards, symbolizing data protection and encryption technologies.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/12/06_Ransomware_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) December 17, 2025 [#### From Linear to Complex: An Upgrade in RansomHouse Encryption](https://unit42.paloaltonetworks.com/ransomhouse-encryption-upgrade/) * [ESXi](https://unit42.paloaltonetworks.com/tag/esxi/ "ESXi") * [Jolly Scorpius](https://unit42.paloaltonetworks.com/tag/jolly-scorpius/ "Jolly Scorpius") * [RansomHouse](https://unit42.paloaltonetworks.com/tag/ransomhouse/ "RansomHouse") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ransomhouse-encryption-upgrade/ "From Linear to Complex: An Upgrade in RansomHouse Encryption") ![Pictorial representation of 01flip ransomware written in Rust. Digital artwork of a pixelated U.S. dollar bill disintegrating into small blocks against a blue data matrix background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/12/05_Ransomware_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) December 10, 2025 [#### 01flip: Multi-Platform Ransomware Written in Rust](https://unit42.paloaltonetworks.com/new-ransomware-01flip-written-in-rust/) * [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin") * [CL-CRI-103](https://unit42.paloaltonetworks.com/tag/cl-cri-103/ "CL-CRI-103") * [Cryptocurrency](https://unit42.paloaltonetworks.com/tag/cryptocurrency/ "Cryptocurrency") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/new-ransomware-01flip-written-in-rust/ "01flip: Multi-Platform Ransomware Written in Rust") ![Pictorial representation of malicious LLMs. Close-up view of a digital wall displaying various glowing icons, representing a high-tech network interface.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/11/AdobeStock_1270203474-786x440.jpeg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) November 25, 2025 [#### The Dual-Use Dilemma of AI: Malicious LLMs](https://unit42.paloaltonetworks.com/dilemma-of-ai-malicious-llms/) * [Credential Harvesting](https://unit42.paloaltonetworks.com/tag/credential-harvesting/ "Credential Harvesting") * [Data exfiltration](https://unit42.paloaltonetworks.com/tag/data-exfiltration/ "data exfiltration") * [LLM](https://unit42.paloaltonetworks.com/tag/llm/ "LLM") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/dilemma-of-ai-malicious-llms/ "The Dual-Use Dilemma of AI: Malicious LLMs") ![Constellation image representing the constellation schema used by Palo Alto Networks Unit 42 to track nation-state and cybercrime threat actor groups](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/Generic-B-1920x900-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/threat-actor-groups.svg)Threat Actor Groups](https://unit42.paloaltonetworks.com/category/threat-actor-groups/) August 1, 2025 [#### Threat Actor Groups Tracked by Palo Alto Networks Unit 42 (Updated Aug. 1, 2025)](https://unit42.paloaltonetworks.com/threat-actor-groups-tracked-by-palo-alto-networks-unit-42/) * [Academic Serpens](https://unit42.paloaltonetworks.com/tag/academic-serpens/ "Academic Serpens") * [Agent Serpens](https://unit42.paloaltonetworks.com/tag/agent-serpens/ "Agent Serpens") * [Agonizing Serpens](https://unit42.paloaltonetworks.com/tag/agonizing-serpens/ "Agonizing Serpens") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/threat-actor-groups-tracked-by-palo-alto-networks-unit-42/ "Threat Actor Groups Tracked by Palo Alto Networks Unit 42 (Updated Aug. 1, 2025)") ![Pictorial representation of Unit 42 threat attribution system. Illustration featuring a white triangle centered within an abstract cosmic background of purple and blue swirls and stars.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/07/Generic-A-1920x900-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/threat-actor-groups.svg)Threat Actor Groups](https://unit42.paloaltonetworks.com/category/threat-actor-groups/) July 31, 2025 [#### Introducing Unit 42's Attribution Framework](https://unit42.paloaltonetworks.com/unit-42-attribution-framework/) * [Advanced Persistent Threat](https://unit42.paloaltonetworks.com/tag/advanced-persistent-threat/ "Advanced Persistent Threat") * [Bookworm](https://unit42.paloaltonetworks.com/tag/bookworm/ "Bookworm") * [Nomenclature](https://unit42.paloaltonetworks.com/tag/nomenclature/ "nomenclature") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/unit-42-attribution-framework/ "Introducing Unit 42’s Attribution Framework") ![Pictorial representation of the ransomware landscape. Digital artwork of a disintegrating U.S. dollar bill with pixelated effects on a cyber-inspired background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/04/05_Ransomware_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-report-white-1.svg)Trend Reports](https://unit42.paloaltonetworks.com/category/trend-reports/) April 23, 2025 [#### Extortion and Ransomware Trends January-March 2025](https://unit42.paloaltonetworks.com/2025-ransomware-extortion-trends/) * [BianLian](https://unit42.paloaltonetworks.com/tag/bianlian/ "BianLian") * [Akira ransomware](https://unit42.paloaltonetworks.com/tag/akira-ransomware/ "Akira ransomware") * [Muddled Libra](https://unit42.paloaltonetworks.com/tag/muddled-libra/ "Muddled Libra") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/2025-ransomware-extortion-trends/ "Extortion and Ransomware Trends January-March 2025") ![A pictorial representation of Akira ransomware, distributed by Howling Scorpius. A person's hand typing on a keyboard with a digital screen displaying the word "password" highlighted in blue, set against a backdrop of various cybersecurity interface graphics.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/11/09_Cybercrime_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) December 2, 2024 [#### Threat Assessment: Howling Scorpius (Akira Ransomware)](https://unit42.paloaltonetworks.com/threat-assessment-howling-scorpius-akira-ransomware/) * [Howling Scorpius](https://unit42.paloaltonetworks.com/tag/howling-scorpius/ "Howling Scorpius") * [Leak site](https://unit42.paloaltonetworks.com/tag/leak-site/ "Leak site") * [Torrenting](https://unit42.paloaltonetworks.com/tag/torrenting/ "torrenting") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/threat-assessment-howling-scorpius-akira-ransomware/ "Threat Assessment: Howling Scorpius (Akira Ransomware)") ![Pictorial representation of a threat like BlackSuit ransomware. An illustration of a modern workspace with a laptop displaying cybersecurity icons, surrounded by stacks of coins and a credit card, all depicted in a neon, digital art style.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/11/04_Ransomware_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) November 20, 2024 [#### Threat Assessment: Ignoble Scorpius, Distributors of BlackSuit Ransomware](https://unit42.paloaltonetworks.com/threat-assessment-blacksuit-ransomware-ignoble-scorpius/) * [BlackSuit ransomware](https://unit42.paloaltonetworks.com/tag/blacksuit-ransomware/ "BlackSuit ransomware") * [Construction](https://unit42.paloaltonetworks.com/tag/construction/ "construction") * [Education](https://unit42.paloaltonetworks.com/tag/education/ "Education") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/threat-assessment-blacksuit-ransomware-ignoble-scorpius/ "Threat Assessment: Ignoble Scorpius, Distributors of BlackSuit Ransomware") ![A representation of a threat group like Jumpy Pisces. Illustrative image featuring two fish and the Pisces constellation superimposed on a stylized, abstract background with flowing purple waves and a starry night sky.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/10/Pisces-NK-A-1920x900-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/threat-actor-groups.svg)Threat Actor Groups](https://unit42.paloaltonetworks.com/category/threat-actor-groups/) October 30, 2024 [#### Jumpy Pisces Engages in Play Ransomware](https://unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/) * [North Korea](https://unit42.paloaltonetworks.com/tag/north-korea/ "North Korea") * [Jumpy Pisces](https://unit42.paloaltonetworks.com/tag/jumpy-pisces/ "Jumpy Pisces") * [Fiddling Scorpius](https://unit42.paloaltonetworks.com/tag/fiddling-scorpius/ "Fiddling Scorpius") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/north-korean-threat-group-play-ransomware/ "Jumpy Pisces Engages in Play Ransomware") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)