Lynx ransomware group lists sce.org.sg on its leak site

• Ransomware group: Lynx
• Country: Singapore
• Sector: Government & Defense
• Announcement date: January 28, 2025

Lynx ransomware group targets Singapore Cooperation Enterprise

The threat actor known as Lynx has listed the domain sce.org.sg on its leak portal, claiming to have compromised the Singapore Cooperation Enterprise (SCE). In a recent announcement posted on January 28, 2025, the group asserted that it has successfully obtained a significant volume of data belonging to the institution. This incident follows a common pattern observed in modern cyberattacks, where ransomware groups employ double extortion tactics. In such scenarios, attackers not only encrypt an organization's systems but also steal sensitive information, threatening to publish it on a public leak site if a ransom is not paid.

The group has issued a ransom demand of 10,000,000 dollars in connection with this alleged breach. This high-value demand highlights the potential impact of targeting government-linked entities that manage sensitive international development and cooperation data.

Details of the alleged data theft

According to the claims made by the Lynx group, the total volume of stolen data is estimated at 144 GB. Based on the information provided in the announcement, the stolen data is categorized into two primary components: 44 GB of general data and a 100 GB SQL database. The breach, as claimed by the attackers, involves the following types of information:

• SQL database
• Corporate data

Ransomware leak sites serve as a platform for these threat actors to exert maximum pressure on their victims. By publishing details about the stolen files, the attackers aim to damage the reputation of the target organization and create urgency for the ransom payment. The presence of a large SQL database in the claim suggests that the attackers may have targeted core information systems to extract structured data.

About the Singapore Cooperation Enterprise

The Singapore Cooperation Enterprise (SCE) is a government agency that was established in 2006. Its primary mission is to share Singapore's development experience with various foreign governments. Functioning as an integrated arm of Enterprise Singapore, the agency plays a vital role in facilitating the transfer of Singapore's public sector expertise. It achieves this through various international collaborations and development projects, serving as a bridge for public sector knowledge sharing on a global scale.

Potential impact and organizational risks

The alleged leak by the Lynx group may pose a high risk due to the nature of the target. Since the SCE is an entity involved in collaborations with Singaporean government agencies, the compromise of its data could have significant implications. The SQL database mentioned in the claim may contain critical information regarding sensitive public projects and international relations. Because the organization is subject to Singaporean regulations and international cooperation protocols, this incident could potentially lead to diplomatic and operational consequences.

Furthermore, the publication of such data can create a foundation for secondary attacks. This includes targeted phishing attempts where attackers use the stolen corporate information to craft highly convincing messages to employees or partners. The sophistication of the attack is also a consideration; the reported code similarity between the Lynx group and INC Ransom suggests that the attack methods utilized in this incident may be highly sophisticated.

For organizations operating within the government and defense sectors, such incidents underscore the necessity of robust defensive measures. Common defensive steps include maintaining rigorous patch management to close vulnerabilities, implementing zero-trust architectures, and conducting regular offline backups to ensure data integrity. Additionally, continuous monitoring of network traffic and employee awareness training are essential components in mitigating the risks posed by sophisticated ransomware groups.