sinobi Ransomware Group
Ransomware group profile
263Victims
RussiaSource country
70Impact score
Description
Sinobi is a financially motivated threat group that employs a hybrid Ransomware-as-a-Service (RaaS) model. Emerging in mid-2025, it is characterized by a disciplined approach to attacks, extensive operational security, and a focus on stealth through living-off-the-land techniques.
Key insights
- •Utilizes a double-extortion model, threatening public disclosure of stolen data if ransom demands are not met.
- •Initial access is commonly gained through stolen VPN or Remote Desktop Protocol (RDP) credentials, often exploiting known vulnerabilities.
- •Employs sophisticated evasion tactics, including disabling endpoint protection, modifying firewall configurations, and data exfiltration using legitimate tools like Rclone.
- •Has been linked to past groups like Lynx and INC due to code overlaps and operational similarities.
- •Targets a diverse range of sectors, with notable attacks on organizations in healthcare and manufacturing.
Threat Level & Status Breakdown
For sinobi · Based on incidents in selected period
2.6threat level
Aggressiveness5/ 10
Lethality0/ 10
Criticality2.7/ 10
Status Breakdown
Claimed100.0%263
First seenJul 2025
Last seenMay 2026
Avg ransom—
Payment rate—
Statusactive
Sophistication0
Last updatedJul 20, 2026
Recent activity
Monthly attack count for sinobi in the selected period
263Total attacks
58peak in Oct
26.3avg / month
↑ 1 vs first month
Intelligence
IOCs, YARA/Sigma rules, and related families for sinobi
- b2398a81b5467f75f476a107027b3259
- acce811c4fc2a6e3fddd4231e386f1648ca44f039d2d275316bc0a0fc96e0af4
- 7ff4e2df39af1f1b8e726e674e69fca7c280f06a
- a088e9ba0a9d8f33bfd8f6294188c58eb01b70d0
- deea481121129d4779195e93fdc39ae62fecb168fd5a384d0ccf8082f06092e5
- efbeeb7c816919d729b74a2ecb909bb6
- 03f94497683ba6db6ba98cbe8070684eb9ebcd13
- 7f37351979c249417cb180b4ede0ed17e5fe2a1f08add4d72606b589f8fdb245
- 9dcfffc9f252189a4ad9d144ccdc8048a4382828
- 39300863bcaad71e5d4efc9a1cae118440aa778f
- e46bde83b8a3a7492fc79c22b337950fc49843a42020c41c615b24579c0c3251
- d65120291dee76c694f8bea54841f7f68329b499b28f4aee5ea5c9369a7432cb
- 6bc8e3505d9f51368ddf323acb6abc49
- 78d359a87ae75ece08976e8b14d877fe
- dcb0e301261b81e5888c0ba6a8ce887b8ed52e5d
- dc9938f51150d13a69fc25f3f19052eacb1bf0a086fd5cf39762501fb3ddd7da
- 1898d056463284d849801cbdea6a3dec6c9f568f01569912c3868a5eea9a5449
- f155e31fdde0c66200b717335038faee161c2812
- 454e398869e189874c796133f68a837c9b7f2190b949a8222453884f84cf4a1b
- 03dd0efa84d145d7d4ed8e240267e5c5
- 2de9c6065dd5c0bcd67cc4d90c10788a
- 2c1dc7f4f97ea6a9e4d0a2e69aea849655bfc9d5
- 765508aa2ec6a1b73a76a23f4fa559d32355622748c91a46ed7b315eae2ee60a
- 3511a9aa2acae34aaadd03073fe09e39
- a768244ca664349a6d1af84a712083c0
- 24f6c0ca39b2a5593086ff56d818ddfbde121f8e44d54faa762e510397dc9db7
- 1b2a1e41a7f65b8d9008aa631f113cef36577e912c13f223ba8834bbefa4bd14
- 31800380c359143ae82c4f9011eee653dd22443d03d6a499148203bbfc275502
- 82cd0af26bc1e9e3b0bfcfe6c61cf467992367a31d87e6bd7e2efa8e9fecbb25
- 02d75d08c89c100685ccb5a72605a22a3cf2460a
- 0ed1f07b1eec40b0452316c842ab3182
- eae09889399fe4fb8e78b114dba0527de913d12fb1802944a88ed136e3e90577
- d4919a7402d7ae02516589fbdfb3cc436749544052843a37b5d36ac4b7385b18
- 549a1ae688edfcb2e7a254ac3aded866b378b2e829f1bb8af42276b902f475e6
- 16bad42a397db2e075e09b5b9dd53aaa67b495a4
- 1d10d8f5a420d0e4683b4cb40bcf0c984d1e7ea1f3b4442a00a525584632ac11
- d26bfb0147f60dc6500a9298d521ee67b49daaf4b8f8be54e7cc8fd86a597570
- 94f73b5dc06ba6705fcef3e759413a747049c2949a0c2e44afc03b2f9989cf73
- 66b4fe7c167799a53ec793f131a7e387216cc813
- e38d4140fce467bfd145a8f6299fc76b8851a62555b5c0f825b9a2200f85017c
- 60aeb9f7bccf377ff02ed64783e66a62c0f976878d9729b067bc7e5b0b9da9d6
- 82ed942a52cdcf120a8919730e00ba37619661a3
- c3804d1329b55a37bfa2f835e1e9bbc7bdb2b260f8e3627c06e02c9f52685d44
- 331d136101b286c2f7198fd41e5018fcadef720ca0e74b282c1a44310a792e7f
- 5cc212f84d2bf3fbab165aaf09b16e00fcf2f1ccd880d24b14404c53dcdbf241
- e06520c65bf27d9110d68ecc0de0e0824c3a99be080ead1a5b5be8fd2a26d12d
- 13ca66d08c04e5be77582f5dd4ab6ca28563b6d9
- 31c3574456573c89d444478772597db40f075e25c67b8de39926d2faa63ca1d8
- 9c35444bdfddbbe92efb045ba93c7fab
- 8d1a22c430252f29611766b8e4a82af0fba60d609246463466b384d6d4793df4
- ce0a95fb73a901a2e3a449e62850f4e5
- 70331fdf528f4f5b75b5e30427e379bc88aa05b4
- 5f0253f959d65c45a11b7436301ee5a851266614f811c753231d684eb5083782
- 4f04f2c98ae0dccf842bd1ab0971b5bd39a7f97a
- ec37a6c4866b7324fce2f11b0e89c4c2
- 08759d9ea2712d693891c870bbebbde3
- 15e5bf0082fbb1036d39fc279293f0799f2ab5b2b0af47d9f3c3fdc4aa93de67
- be3d939747ad05764b2d9dd461697093
- 589d9480fbfec2d8e61638eb0b537183d0f9977411fd1d2c0f8eb611feebe880
- e1c371c7c39c16d208bcbaa5b5d0714df696e6ef68b95a880673a904527c8b96
- 6c6f13872bb7d18692bfc04757302f98d951217b
- a9bc032353bd246ba50af1b8d4849bfd
- 5b63a1dc187670723d02b4b675255a20a70d10b8
- e14ba0fb92e16bb7db3b1efac4b13aee178542c6994543e7535d8efaa589870c
- bf8c45e5aa9551a17eefbd1d179422c32b4309c47ee9a3f315bb80ed6d4f7efc
- 266bab046cf4b7ddd9655416179f07bcab59d409
- 85befc3111bc28dc9715570a068412ba
- ff5da8f0330a4c581c37284c74aae2683c007dc6e406e1e2e6803e7bb398b77b
- c192ef6c4143b8df43ea7855224e77ecd4f34080
- 44af7a778a0089836625b10df1ae91c99a984170
- ec5366d5b9e6ef094c1583170c85f4fe4f38e1e2
- 3dba9ba8e265faefce024960b69c1f472ab7a898e7c224145740f1886d97119f
- 8bd32c26db7ebd8d0764a8292d536a76fd8b1d5e
- 265a8e89464e32b22553ef16edbab703da7176a7
- 5fff877789223fa9810a365dfdeafe982c92f346ecd20e003319c3067becd8ba
- 6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141
- 81b41cf5effc3b259436d9864e8e2db703ad3743
- ea721240c14e3d14f8d88e0020880448c6c602f1180a1e5dbe40871cfeedcc22
- 6bf155b269d452f3c3b62832b27bbebe4da436e228dbf521155b1d5989e3743f
- 8bb8c6e72d20e9b07bb55e0b0d168efe99d0088122131ae96d13fa01d3325a17
- 00454046c6be47839226fc55da5bc492e5d4f99c
- 7eec7d07587112777016e5742c0d002d7e64a3e1fe7bde82fed8f65e3663456a
- 073bb9994c0688aa092ce81b077199088c9353ce
- 2149a070e76f4ccabd67228f754768dc
- 6d28d0ad4c7192bf8fccd1be1e10d5d9
- 97aebda5482899fef84a24e456bff055acaa47e5ab4029f768d9e0c62a660ce2
- eb37c4fcfc00d3813ab94f4d59378b47
- 16f83f056177c4ec24c7e99d01ca9d9d6713bd0497eeedb777a3ffefa99c97f0
- fcc3cbe8bfe18f08eadda3acd4258369
- e7288f4e4cf20e219a0394d5dabb82b6
- f488861f8d3d013c3eef88983de8f5f37bb014ae13dc13007b26ebbd559e356e
- ef88cf8a71b4dfca2c46cc3fedf70246
- f6a01d0246ce31faf6938ea488086d4358505405a4ef5c5faa482e79e92cb347
- dce9ad6317ce147f1f3f74bc93d9252a
- 90e46e89fec2108a1cb4850bb33e3563e92a14d04e1e613ac8c9311f152d294c
- abbd165dab5580e1905e87a8ac5139a4232fd908
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for sinobi
CVE-2024-40766
Defense Evasion
T1070
Indicator Removal
T1562.001
Disable or Modify Tools
Execution
T1059.001
PowerShell
Impact
T1486
Data Encrypted for Impact
T1490
Inhibit System Recovery
Lateral Movement
T1021.001
Remote Desktop Protocol
Persistence
T1543.003_1
Windows Service
Victims(200)
| Company | Domain | Country | Industry | Status | Discovered | |
|---|---|---|---|---|---|---|
| Neurotrials Research Inc | — | US United States | Healthcare | Claimed | 2 months ago | |
| Scales and Associates Inc | — | US United States | Professional Services | Claimed | 3 months ago | |
| Unre3d | — | CN China | Technology | Claimed | 3 months ago | |
| Bay State Land Services | — | US United States | Other | Claimed | 3 months ago | |
| Celeris Networks | — | US United States | Technology | Claimed | 3 months ago | |
| Positiwise Infotech Pvt | — | IN India | Technology | Claimed | 3 months ago | |
| Amerinational Management Services (AMS) | ourams.com | US United States | Professional Services | Claimed | 4 months ago | |
| Elgi Electric & Industries | elgielectric.com | IN India | Manufacturing | Claimed | 4 months ago | |
| Interpack Northwest | interpacknorthwest.com | US United States | Other | Claimed | 4 months ago | |
| Summa Energy | summaenergy.com | US United States | Energy & Utilities | Claimed | 4 months ago | |
| Teco | teco.com | US United States | Energy & Utilities | Claimed | 4 months ago | |
| McAfee Tool & Die | mcafeetool.com | US United States | Manufacturing | Claimed | 4 months ago | |
| Eco Sound Builders | ecosoundbuilders.com | US United States | Other | Claimed | 4 months ago | |
| Graymatter | graymatter.com | GB United Kingdom | Technology | Claimed | 5 months ago | |
| Iblesoft | iblesoft.com | US United States | Technology | Claimed | 5 months ago | |
| Mayfair Hotels & Resorts | mayfairhotels.com | IN India | Hospitality | Claimed | 5 months ago | |
| Gentegra | gentegra.com | US United States | Technology | Claimed | 5 months ago | |
| Electriduct | electriduct.com | US United States | Manufacturing | Claimed | 5 months ago | |
| Saltech Systems | saltechsystems.com | US United States | Technology | Claimed | 5 months ago | |
| The Sundher Group | sundhergroup.com | CA Canada | Other | Claimed | 5 months ago |
Page 1 of 10
Affected countries(56)
Countries where this group has been reported to target or leak victims.
🇦🇪United Arab Emirates🇦🇷Argentina🇦🇹Austria🇦🇺Australia🇧🇪Belgium🇧🇷Brazil🇧🇸Bahamas🇨🇦Canada🇨🇭Switzerland🇨🇱Chile🇨🇳China🇨🇴Colombia🇨🇷Costa Rica🇨🇿Czech Republic🇩🇪Germany🇩🇰Denmark🇩🇲Dominica🇪🇸Spain🇪🇹Ethiopia🇫🇮Finland🇫🇷France🇬🇧United Kingdom🇭🇰Hong Kong🇮🇩Indonesia🇮🇱Israel🇮🇳India🇮🇹ItalyJersey🇯🇵Japan🇰🇪KenyaKorea, Republic of🇲🇦Morocco🇲🇹Malta🇲🇽Mexico🇲🇾Malaysia🇳🇱Netherlands🇳🇴Norway🇳🇿New Zealand🇵🇪Peru🇵🇭Philippines🇵🇱PolandPuerto Rico🇵🇹Portugal🇵🇾Paraguay🇷🇴RomaniaRussian Federation🇸🇦Saudi Arabia🇸🇪Sweden🇸🇬Singapore🇸🇮Slovenia🇹🇭Thailand🇹🇷TurkeyTaiwan, Province of China🇺🇸United StatesVenezuela, Bolivarian Republic of🇿🇦South Africa