Researchers have reported that the INC ransomware group may have rebranded itself as Lynx following a notable shift in recent activity and tactics over the last three (3) months. While INC was previously known for targeting organizations like Leicester City Council and NHS Scotland, its activity has decreased since Lynx emerged in July 2024. The number of Lynx ransomware samples detected since its emergence has outpaced those of INC ransomware, leading to speculation about a rebranding. This is supported by code analysis, revealing a 70.8% match in shared functions between the two (2) groups, suggesting that Lynx likely repurposed the INC codebase. This practice of code reuse is common among cybercriminals, allowing them to build upon existing frameworks to expedite the development of new attacks. Despite the decline in INC’s visibility, recent victim postings on its leak site suggest ongoing activity. Both INC and Lynx maintain clear web presences with similarly designed leak sites, reinforcing the idea of a connection between the two (2). However, Lynx distinguishes itself by claiming to avoid targeting hospitals, governments, and nonprofits, marking a potential shift in operational ethics compared to INC’s historical attacks. CTIX will continue to monitor the activity of Lynx, along with other emerging threat actor shifts and trends.