ransomware

Sinobi

dormant · last signal 1mo agoAttribution: ModeratePlausible and partly corroborated — some gaps or single-source elements.

Ransomware

Attribution

Unattributed cybercriminal ransomware-as-a-service (RaaS) operation. Multiple independent vendors (SoCRadar, Barracuda, eSentire, Blackpoint, Halcyon) assess with medium-to-high confidence that Sinobi is a rebrand or offshoot of the Lynx ransomware gang, which itself descended from the INC Ransom family (INC source code reportedly sold on underground forums in spring 2024 and acquired by Lynx operators). Binary code-similarity analysis reported publicly shows roughly 63% function overlap with Lynx and roughly 56% with INC. No nation-state attribution; no confirmed real-world identities. Lineage is a strong analytic assessment, not a confirmed fact.

First seen

2025-06

Last active

2026-05-08

Motivation

Financial (double-extortion ransomware: data theft plus encryption, with threat to publish exfiltrated data on a Tor leak site if the ransom is unpaid).

Attribution confidence

medium

MENA targeting

Saudi Arabia

Sectors

Agriculture/food

Corpus activity · 6mo1 mention

AMJJAS

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

Why it mattersRansomware actor, medium confidence, documented targeting Saudi Arabia (Agriculture/food sector).

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

Associated with

Related to

BianLianactorTechnique overlap
BrainCipheractorTechnique overlap
NovaactorTechnique overlap
KillSecactorTechnique overlap
RhysidaactorTechnique overlap
Cicada3301actorTechnique overlap
IncRansomactorTechnique overlap
DevmanactorTechnique overlap
RansomHubactor

Reporting history

1 reports · 0 publishers

Third-party sources archived via ORKL — not RaqibCTI assessments. Reported since 2026-04-16.

A2026-04-16

2025_IC3Report.pdf

📄 PDF 📃 text ↗ ORKL ↗ source

Recent mentions

Latest Intel →

2026-07-28Cisco Talos — IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains ↗

Sources

01Dark Web Profile: Sinobi Ransomware — SOCRadar, 2025 ↗02Sinobi: The bougie-exclusive ransomware group that wants to be a ninja — Barracuda Networks, 2025-11-17 ↗03Threat Actors Deploy Sinobi Ransomware via Compromised SonicWall SSL VPN Credentials ↗

Useful?

Suggested · co-occurring (unverified)

These entities are frequently mentioned together in source material; co-occurrence is not a verified relationship.

TechniqueT1566co-mentioned in 1 item
SectorPublic Administrationco-mentioned in 1 item
TechniqueT1566.001co-mentioned in 1 item
MalwareNitrogenco-mentioned in 1 item
TechniqueT1021.001co-mentioned in 1 item
SectorHealthcareco-mentioned in 1 item
Malwarercloneco-mentioned in 1 item
TechniqueT1003.003co-mentioned in 1 item
MalwareMeshAgentco-mentioned in 1 item
TechniqueT1484.001co-mentioned in 1 item
TechniqueT1621co-mentioned in 1 item
TechniqueT1566.002co-mentioned in 1 item
CountryAustraliaco-mentioned in 1 item
MalwareARTokenco-mentioned in 1 item
TechniqueT1078co-mentioned in 1 item
SectorManufacturingco-mentioned in 1 item
TechniqueT1567.002co-mentioned in 1 item
TechniqueT1219co-mentioned in 1 item
MalwareZoho Assistco-mentioned in 1 item
MalwareWarlockco-mentioned in 1 item
TechniqueT1021.006co-mentioned in 1 item
TechniqueT1528co-mentioned in 1 item
TechniqueT1557co-mentioned in 1 item
MalwareEvilTokensco-mentioned in 1 item
TechniqueT1539co-mentioned in 1 item
TechniqueT1190co-mentioned in 1 item
MalwareSinobico-mentioned in 1 item

Suggested · co-occurring (unverified)

These entities are frequently mentioned together in source material; co-occurrence is not a verified relationship.

TechniqueT1566co-mentioned in 1 item
SectorPublic Administrationco-mentioned in 1 item
TechniqueT1566.001co-mentioned in 1 item
MalwareNitrogenco-mentioned in 1 item
TechniqueT1021.001co-mentioned in 1 item
SectorHealthcareco-mentioned in 1 item
Malwarercloneco-mentioned in 1 item
TechniqueT1003.003co-mentioned in 1 item
MalwareMeshAgentco-mentioned in 1 item
TechniqueT1484.001co-mentioned in 1 item
TechniqueT1621co-mentioned in 1 item
TechniqueT1566.002co-mentioned in 1 item
CountryAustraliaco-mentioned in 1 item
MalwareARTokenco-mentioned in 1 item
TechniqueT1078co-mentioned in 1 item
SectorManufacturingco-mentioned in 1 item
TechniqueT1567.002co-mentioned in 1 item
TechniqueT1219co-mentioned in 1 item
MalwareZoho Assistco-mentioned in 1 item
MalwareWarlockco-mentioned in 1 item
TechniqueT1021.006co-mentioned in 1 item
TechniqueT1528co-mentioned in 1 item
TechniqueT1557co-mentioned in 1 item
MalwareEvilTokensco-mentioned in 1 item
TechniqueT1539co-mentioned in 1 item
TechniqueT1190co-mentioned in 1 item
MalwareSinobico-mentioned in 1 item