Attribution
Unattributed cybercriminal ransomware-as-a-service (RaaS) operation. Multiple independent vendors (SoCRadar, Barracuda, eSentire, Blackpoint, Halcyon) assess with medium-to-high confidence that Sinobi is a rebrand or offshoot of the Lynx ransomware gang, which itself descended from the INC Ransom family (INC source code reportedly sold on underground forums in spring 2024 and acquired by Lynx operators). Binary code-similarity analysis reported publicly shows roughly 63% function overlap with Lynx and roughly 56% with INC. No nation-state attribution; no confirmed real-world identities. Lineage is a strong analytic assessment, not a confirmed fact.