Threat Actors Exploit RDP Access to Deploy Lynx Ransomware and Wipe Backups

Fast Facts

1. Lynx ransomware campaigns are highly sophisticated, involving extensive reconnaissance, lateral movement, and targeted backup destruction to maximize disruption and extortion success.
2. Attackers initially gain access through legitimate RDP credentials without brute-force force, then meticulously map networks and establish persistent access using tools like AnyDesk.
3. A key tactic involves systematically deleting backup infrastructure before deploying ransomware, effectively removing recovery options and increasing extortion leverage.
4. The entire attack process spans approximately nine days, highlighting the attackers’ strategic planning to identify high-value targets and ensure successful encryption and data exfiltration.

Underlying Problem

The Lynx ransomware campaign represents a meticulously planned cyberattack aimed at devastating enterprise networks by combining data theft and infrastructure sabotage. Initiated in early March 2025, attackers gained unauthorized access through legitimate Remote Desktop Protocol credentials, likely obtained through prior breaches or malware infestations, rather than brute-force methods. Once inside, they executed a strategic reconnaissance, expanding their control by creating fictitious user accounts and installing remote access tools like AnyDesk to maintain persistence. Over several days, they methodically mapped the network, collected sensitive data, and exfiltrated files, all while meticulously destroying backup systems to prevent recovery. The attackers’ extended preparatory phase—lasting about nine days—culminated in deploying Lynx ransomware, encrypting vital data across multiple servers, and leaving organizations unable to restore systems from backups, significantly amplifying their extortion leverage. This sophisticated operation, monitored and analyzed by DFIR security experts, underscores the evolving threat landscape in which cybercriminals employ patience and precision to maximize impact and extortion potential on targeted companies.

The report highlights that the attack was carried out by unidentified threat actors who exploited legitimate credentials, avoiding common detection methods like credential stuffing. Their deliberate destruction of backup infrastructure before executing the ransomware illustrates a calculated effort to hinder disaster recovery and strengthen their coercive power. By exfiltrating sensitive data and crippling backup options, these attackers aimed to maximize organizational disruption and increase pressure for ransom payments. The detailed timeline and tactics, documented by DFIR analysts, emphasize the importance of vigilant security measures, robust backup protocols, and early detection to thwart similarly sophisticated future assaults.

Risks Involved

The escalating threat of cybercriminals exploiting compromised Remote Desktop Protocol (RDP) logins to deploy Lynx ransomware post-deletion of server backups poses a severe danger to businesses of all sizes, as it allows hackers to gain unauthorized access, immobilize critical data through encryption, and leave organizations defenseless without reliable backups, leading to significant operational disruptions, financial losses, reputation damage, and legal liabilities—underscoring the urgent need for robust security measures, vigilant monitoring, and comprehensive backup strategies to prevent such devastating cyberattacks.

Possible Remediation Steps

Timely remediation in cybersecurity is crucial to minimize damage, prevent widespread infection, and restore normal operations swiftly. When threat actors exploit compromised RDP logins to deploy Lynx ransomware and delete server backups, swift action can significantly reduce ransom demands, data loss, and operational disruption.

Containment Measures

• Immediately isolate affected systems to prevent lateral movement.
• Disable compromised accounts and remove unauthorized access.

Identification & Analysis

• Conduct rapid threat hunting to identify entry points and affected assets.
• Review logs for suspicious activities or login anomalies.

Eradication Efforts

• Remove malicious files, scripts, or backdoors associated with the attack.
• Patch vulnerabilities in RDP services and related software.

Restoration Strategies

• Restore data from verified backups, ensuring backups are free of malware.
• Reconfigure and strengthen RDP security protocols before resuming operations.

Prevention & Monitoring

• Implement multi-factor authentication (MFA) for remote access.
• Enforce least privilege access and regular password updates.
• Deploy endpoint detection and response (EDR) tools for continuous monitoring.
• Regularly review and update security policies and configurations.

Explore More Security Insights

Explore career growth and education via Careers & Learning, or dive into Compliance essentials.

Learn more about global cybersecurity standards through the NIST Cybersecurity Framework.

Disclaimer: The information provided may not always be accurate or up to date. Please do your own research, as the cybersecurity landscape evolves rapidly. Intended for secondary references purposes only.

Cyberattacks-V1cyberattack-v1-multisource