RansomedTrust - Lynx Lab

On April 30, 2026, a multinational organization operating across two trusted Active Directory forests was paralyzed within hours. Encrypted files surfaced across workstations, file servers, and domain controllers; ransom notes flooded every shared folder; and a defaced desktop wallpaper appeared on every reachable system. Initial triage uncovered a forgotten Linux development web server that had been public-facing and unpatched for years. The host carried a second network interface wired directly into the internal corporate network and sat completely outside the SIEM's monitoring scope, giving the attacker a silent bridge between the internet and the internal estate from which the rest...