{"type":"bundle","id":"bundle--7782b943-d5c5-5da1-b3f9-321694b1e41c","objects":[{"type":"identity","spec_version":"2.1","id":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-01-01T00:00:00.000Z","modified":"2026-01-01T00:00:00.000Z","name":"CTI-Hermes Autonomous Agent","identity_class":"organization"},{"type":"indicator","spec_version":"2.1","id":"indicator--46855c17-9f55-5b1f-82fd-af4971d5b066","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-08-29T13:15:02.041306Z","modified":"2026-08-29T13:15:02.041306Z","name":"SIGMA: Lynx Ransomware File Encryption and Service Termination","indicator_types":["malicious-activity"],"pattern":"[network-traffic:dst_ref.value = 'Lynx Ransomware File Encryption and Service Termination']","pattern_type":"stix","pattern_version":"2.1","valid_from":"2026-08-29T13:15:02.041306Z","confidence":95},{"type":"indicator","spec_version":"2.1","id":"indicator--cd2e6ebc-6689-5338-83c7-b68494d4626e","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-08-29T13:15:02.041306Z","modified":"2026-08-29T13:15:02.041306Z","name":"YARA: MAL_RANSOM_Lynx_Locker","indicator_types":["malicious-activity"],"pattern":"[network-traffic:dst_ref.value = 'MAL_RANSOM_Lynx_Locker']","pattern_type":"stix","pattern_version":"2.1","valid_from":"2026-08-29T13:15:02.041306Z","confidence":95},{"type":"report","spec_version":"2.1","id":"report--da86ed13-956d-5e1b-87cb-31af43246fd9","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-08-29T13:15:02.041306Z","modified":"2026-10-30T14:11:24.973701Z","name":"Analysis of Cat’s Got Your Files: Lynx Ransomware","description":"Technical threat analysis derived from intelligence published at https://thedfirreport.com/2025/12/17/cats-got-your-files-lynx-ransomware/.\n\nCat’s Got Your Files: Lynx Ransomware Key Takeaways The DFIR Report Services Contact us today for pricing or a demo! The intrusion began in early March 2025 with a single successful Remote Desktop Protocol (RDP) logon to an internet-exposed system. Notably, there was no evidence of credential stuffing, brute forcing, or other failed authentication attempts from the source IP, indicating the […] The post Cat’s Got Your Files: Lynx Ransomware appeared first on The DFIR Report.","published":"2026-08-29T13:15:02.041306Z","report_types":["threat-report"],"object_refs":["identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","indicator--46855c17-9f55-5b1f-82fd-af4971d5b066","indicator--cd2e6ebc-6689-5338-83c7-b68494d4626e"],"confidence":95}]}