sinobi

Key insights

• •Utilizes a double-extortion model, threatening public disclosure of stolen data if ransom demands are not met.
• •Initial access is commonly gained through stolen VPN or Remote Desktop Protocol (RDP) credentials, often exploiting known vulnerabilities.
• •Employs sophisticated evasion tactics, including disabling endpoint protection, modifying firewall configurations, and data exfiltration using legitimate tools like Rclone.
• •Has been linked to past groups like Lynx and INC due to code overlaps and operational similarities.
• •Targets a diverse range of sectors, with notable attacks on organizations in healthcare and manufacturing.