Lynx ransomware group lists Concut (ddm.local) on its leak site

• Ransomware group: Lynx
• Country: United States
• Sector: Professional Services
• Announcement date: August 9, 2024

Lynx claims data exfiltration from Concut

The Lynx ransomware group has officially listed Concut (ddm.local) on its dedicated leak site. According to the announcement made by the threat actors, the group claims to have successfully exfiltrated data from the organization's internal systems. This development follows a period of unauthorized access that the group alleges occurred prior to the public listing.

The threat actor known as Lynx added Concut (ddm.local) to its leak site on August 9, 2024. The group claims to have gained access to the organization's internal networks and subsequently exfiltrated various documents. To support their claims and provide proof of the breach, the group has provided sample files related to the organization's operations as part of the announcement.

Affected data types

Based on the screenshots provided by the attackers, the leaked information includes sensitive documents related to the organization's internal administration and personnel. The specific types of data identified in the sample files include:

• Employee expense records
• Separation agreements

The presence of such documents suggests that the breach may involve sensitive personal and financial information belonging to the organization's workforce.

Organization profile

Concut (ddm.local) is an established entity in the professional services sector. Founded in 1946, DDM CONCUT is a manufacturer of diamond-tipped tools and equipment specifically designed for concrete cutting and drilling applications. The company was formed through the merger of Dixie Diamond Manufacturing and Concut.

Analysis and implications

Lynx is a Ransomware-as-a-Service (RaaS) group that emerged in 2024. Technical observations have reported that the group shares code similarities with INC Ransom. The group appears to utilize double extortion tactics, a method where attackers not only encrypt an organization's data but also threaten to release sensitive information publicly to increase pressure for ransom payments. Because of this tactic, it is possible that further data could be released in the future.

The alleged exfiltration of documents containing personal and financial information of employees may increase the risk of identity theft and targeted phishing attacks against the staff. Furthermore, as the organization is based in the United States, the incident may lead to legal proceedings under state-level data privacy regulations. The breach may also result in negative impacts on the organization's operational continuity and reputation.

In general, when organizations face such threats, defensive measures often include implementing robust network segmentation, enforcing multi-factor authentication, and maintaining regular, offline backups. For companies in the professional services and manufacturing sectors, protecting intellectual property and employee data is critical to maintaining trust and adhering to regulatory frameworks.