Sinobi · Ransomware · RaqibCTI

+ Request intel workspace

ransomware

Sinobi

dormant · last signal 1mo agoAttribution: ModeratePlausible and partly corroborated — some gaps or single-source elements.

Ransomware

Attribution

Unattributed cybercriminal ransomware-as-a-service (RaaS) operation. Multiple independent vendors (SoCRadar, Barracuda, eSentire, Blackpoint, Halcyon) assess with medium-to-high confidence that Sinobi is a rebrand or offshoot of the Lynx ransomware gang, which itself descended from the INC Ransom family (INC source code reportedly sold on underground forums in spring 2024 and acquired by Lynx operators). Binary code-similarity analysis reported publicly shows roughly 63% function overlap with Lynx and roughly 56% with INC. No nation-state attribution; no confirmed real-world identities. Lineage is a strong analytic assessment, not a confirmed fact.

First seen

2025-06

Last active

2026-05-08

Motivation

Financial (double-extortion ransomware: data theft plus encryption, with threat to publish exfiltrated data on a Tor leak site if the ransom is unpaid).

Attribution confidence

medium

MENA targeting

Saudi Arabia

Sectors

Agriculture/food

Corpus activity · 6mo1 mention

AMJJAS

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

Why it mattersRansomware actor, medium confidence, documented targeting Saudi Arabia (Agriculture/food sector).

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

Associated with

Related to

BianLianactorTechnique overlap
BrainCipheractorTechnique overlap
NovaactorTechnique overlap
KillSecactorTechnique overlap
RhysidaactorTechnique overlap
Cicada3301actorTechnique overlap
IncRansomactorTechnique overlap
DevmanactorTechnique overlap
RansomHubactor

Overview

Sinobi is a private, vetted-affiliate ransomware-as-a-service operation that emerged publicly in late June / early July 2025. It runs a double-extortion model with a Tor-based data leak site whose infrastructure closely mirrored earlier Lynx sites, and is widely assessed to be a rebrand/successor in the INC -> Lynx -> Sinobi lineage. Reported initial access relies heavily on compromised SonicWall SSL VPN credentials and unpatched SonicWall devices (CVE-2024-40766, CVE-2024-53704), with some reporting of Oracle E-Business Suite exploitation (CVE-2025-61882). Victims skew toward mid-market and larger US organizations across manufacturing, professional services, healthcare, technology and retail.

History

Sinobi was first flagged by trackers around 5 July 2025 after Tor leak infrastructure was observed in late June 2025 mirroring Lynx sites, suggesting staging before public emergence. Activity ramped through July 2025 and continued steadily through the rest of the year; ransomware.live records the operation claiming on the order of 270+ victims by end of 2025, heavily concentrated in the United States (roughly 205), with smaller tallies in India, the United Kingdom, France and Taiwan. Analysts characterize it as a semi-private RaaS with a small core team and strictly screened affiliates. Technical lineage to Lynx and INC is supported by leak-site infrastructure reuse, TTP overlap and reported binary code similarity (~63% vs Lynx, ~56% vs INC). Per ransomware.live the group went quiet in 2026, last seen around 8 May 2026 and inactive for ~120 days as of mid-2026; whether this is a pause, wind-down or further rebrand is unconfirmed.

MENA relevance: The Saudi Arabia tag is not clearly supported by the vendor reporting reviewed (Barracuda, eSentire, Blackpoint and Halcyon describe predominantly US/Canada/Australia/European victimology), and no Saudi Arabian entry appears on ransomware.live at the time of writing — treat the Saudi tag as unverified / low-confidence. Sinobi is not a MENA-focused actor.

Notable campaigns

2025

SonicWall SSL VPN intrusion campaign

Reported by eSentire and others: affiliates deployed Sinobi ransomware after gaining access through compromised SonicWall SSL VPN credentials and unpatched SonicWall devices (CVE-2024-40766, CVE-2024-53704), followed by data exfiltration and encryption in a double-extortion model.

Useful?