Latest Research on INC and The Gentlemen Ransomware: Exposed AI Infrastructure
sinobi Ransomware Group
Ransomware group profile
158Victims
RussiaSource country
75Impact score
Description
Sinobi is a financially motivated threat group that employs a hybrid Ransomware-as-a-Service (RaaS) model. Emerging in mid-2025, it is characterized by a disciplined approach to attacks, extensive operational security, and a focus on stealth through living-off-the-land techniques.
Key insights
- •Utilizes a double-extortion model, threatening public disclosure of stolen data if ransom demands are not met.
- •Initial access is commonly gained through stolen VPN or Remote Desktop Protocol (RDP) credentials, often exploiting known vulnerabilities.
- •Employs sophisticated evasion tactics, including disabling endpoint protection, modifying firewall configurations, and data exfiltration using legitimate tools like Rclone.
- •Has been linked to past groups like Lynx and INC due to code overlaps and operational similarities.
- •Targets a diverse range of sectors, with notable attacks on organizations in healthcare and manufacturing.
Threat Level & Status Breakdown
For sinobi · Based on incidents in selected period
Status Breakdown
Claimed100.0%158
First seenNov 2025
Last seenMay 2026
Avg ransom—
Payment rate—
Statusactive
Sophistication0
Last updatedNov 10, 2026
Recent activity
Monthly attack count for sinobi in the selected period
158Total attacks
57peak in Jan
26.3avg / month
↓ 11 vs first month
Intelligence
IOCs, YARA/Sigma rules, and related families for sinobi
- 7eec7d07587112777016e5742c0d002d7e64a3e1fe7bde82fed8f65e3663456a
- e1c371c7c39c16d208bcbaa5b5d0714df696e6ef68b95a880673a904527c8b96
- 82ed942a52cdcf120a8919730e00ba37619661a3
- 6bc8e3505d9f51368ddf323acb6abc49
- 16f83f056177c4ec24c7e99d01ca9d9d6713bd0497eeedb777a3ffefa99c97f0
- 31c3574456573c89d444478772597db40f075e25c67b8de39926d2faa63ca1d8
- edd1be036b00de9a2a09a03d8e0e8ec392c5ee7b
- dd475afd948cc22caa2a0f934d0aec52
- 08759d9ea2712d693891c870bbebbde3
- d4919a7402d7ae02516589fbdfb3cc436749544052843a37b5d36ac4b7385b18
- 265a8e89464e32b22553ef16edbab703da7176a7
- 03dd0efa84d145d7d4ed8e240267e5c5
- 6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141
- 9c35444bdfddbbe92efb045ba93c7fab
- deea481121129d4779195e93fdc39ae62fecb168fd5a384d0ccf8082f06092e5
- 1b2a1e41a7f65b8d9008aa631f113cef36577e912c13f223ba8834bbefa4bd14
- 2149a070e76f4ccabd67228f754768dc
- 15e5bf0082fbb1036d39fc279293f0799f2ab5b2b0af47d9f3c3fdc4aa93de67
- 13ca66d08c04e5be77582f5dd4ab6ca28563b6d9
- b2398a81b5467f75f476a107027b3259
- 7f37351979c249417cb180b4ede0ed17e5fe2a1f08add4d72606b589f8fdb245
- 5cc212f84d2bf3fbab165aaf09b16e00fcf2f1ccd880d24b14404c53dcdbf241
- 60aeb9f7bccf377ff02ed64783e66a62c0f976878d9729b067bc7e5b0b9da9d6
- 8bd32c26db7ebd8d0764a8292d536a76fd8b1d5e
- 765508aa2ec6a1b73a76a23f4fa559d32355622748c91a46ed7b315eae2ee60a
- d26bfb0147f60dc6500a9298d521ee67b49daaf4b8f8be54e7cc8fd86a597570
- 266bab046cf4b7ddd9655416179f07bcab59d409
- 32827e9bdf630d974531c2f715d2426c
- 97aebda5482899fef84a24e456bff055acaa47e5ab4029f768d9e0c62a660ce2
- ec5366d5b9e6ef094c1583170c85f4fe4f38e1e2
- 2de9c6065dd5c0bcd67cc4d90c10788a
- a700329f65470db3b7489005218f3937
- 3511a9aa2acae34aaadd03073fe09e39
- 02d75d08c89c100685ccb5a72605a22a3cf2460a
- 90e46e89fec2108a1cb4850bb33e3563e92a14d04e1e613ac8c9311f152d294c
- e7288f4e4cf20e219a0394d5dabb82b6
- fcc3cbe8bfe18f08eadda3acd4258369
- 589d9480fbfec2d8e61638eb0b537183d0f9977411fd1d2c0f8eb611feebe880
- be3d939747ad05764b2d9dd461697093
- c192ef6c4143b8df43ea7855224e77ecd4f34080
- ea721240c14e3d14f8d88e0020880448c6c602f1180a1e5dbe40871cfeedcc22
- acce811c4fc2a6e3fddd4231e386f1648ca44f039d2d275316bc0a0fc96e0af4
- 16bad42a397db2e075e09b5b9dd53aaa67b495a4
- dce9ad6317ce147f1f3f74bc93d9252a
- ff5da8f0330a4c581c37284c74aae2683c007dc6e406e1e2e6803e7bb398b77b
- f6a01d0246ce31faf6938ea488086d4358505405a4ef5c5faa482e79e92cb347
- dc9938f51150d13a69fc25f3f19052eacb1bf0a086fd5cf39762501fb3ddd7da
- d65120291dee76c694f8bea54841f7f68329b499b28f4aee5ea5c9369a7432cb
- bf8c45e5aa9551a17eefbd1d179422c32b4309c47ee9a3f315bb80ed6d4f7efc
- 8d1a22c430252f29611766b8e4a82af0fba60d609246463466b384d6d4793df4
- 6bf155b269d452f3c3b62832b27bbebe4da436e228dbf521155b1d5989e3743f
- 24f6c0ca39b2a5593086ff56d818ddfbde121f8e44d54faa762e510397dc9db7
- 1d10d8f5a420d0e4683b4cb40bcf0c984d1e7ea1f3b4442a00a525584632ac11
- 1898d056463284d849801cbdea6a3dec6c9f568f01569912c3868a5eea9a5449
- abbd165dab5580e1905e87a8ac5139a4232fd908
- 6d28d0ad4c7192bf8fccd1be1e10d5d9
- 4f04f2c98ae0dccf842bd1ab0971b5bd39a7f97a
- 0ed1f07b1eec40b0452316c842ab3182
- 81b41cf5effc3b259436d9864e8e2db703ad3743
- a9bc032353bd246ba50af1b8d4849bfd
- 9dcfffc9f252189a4ad9d144ccdc8048a4382828
- ec37a6c4866b7324fce2f11b0e89c4c2
- 6c6f13872bb7d18692bfc04757302f98d951217b
- ce0a95fb73a901a2e3a449e62850f4e5
- 5b63a1dc187670723d02b4b675255a20a70d10b8
- ef88cf8a71b4dfca2c46cc3fedf70246
- 073bb9994c0688aa092ce81b077199088c9353ce
- 78d359a87ae75ece08976e8b14d877fe
- 2c1dc7f4f97ea6a9e4d0a2e69aea849655bfc9d5
- f155e31fdde0c66200b717335038faee161c2812
- 7ff4e2df39af1f1b8e726e674e69fca7c280f06a
- 85befc3111bc28dc9715570a068412ba
- a088e9ba0a9d8f33bfd8f6294188c58eb01b70d0
- 03f94497683ba6db6ba98cbe8070684eb9ebcd13
- efbeeb7c816919d729b74a2ecb909bb6
- 44af7a778a0089836625b10df1ae91c99a984170
- 66b4fe7c167799a53ec793f131a7e387216cc813
- 914ff51fb60247cf13897b1bc950a190
- 6f9e1371427be15a840c2de5eb1719a466af2016
- bd91d786841f5259430c1c90b454d9f8bf510186fe4d32a0998bd9b5a7916467
- 31f94910c9e23ca777f589fe7d3d708e4f88c1b6a7518fdf8c55346865dd35fe
- bc0739e209d086dae2e0ed40bbf9bbf1
- e020eeb1b70a144265775693591164b316e34071
- e6ec7749e3d0f750fa53b5a7619d1e5af57673d236338b3a020d0f534ec5c15d
- d213bccd00f98d8af608186035bc8bf814e13364
- 7ee443b0530bb9fe4c36c0faafdeb6bc
- a06a9bdcd93b52481162f4f65a2d6c2e
- 36706fc47007cb10b2ea12ecc1cd133bfeacde09
- 7f34666025abf6463c84f4dfde8bfdcdb9dfbe6f3e63ed3e0db0758a2ea4d32d
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for sinobi
CVE-2024-40766
Defense Evasion
T1070
Indicator Removal
T1562.001
Disable or Modify Tools
Execution
T1059.001
PowerShell
Impact
T1486
Data Encrypted for Impact
T1490
Inhibit System Recovery
Lateral Movement
T1021.001
Remote Desktop Protocol
Persistence
T1543.003_1
Windows Service
Affected countries(56)
Countries where this group has been reported to target or leak victims.
🇦🇪United Arab Emirates🇦🇷Argentina🇦🇹Austria🇦🇺Australia🇧🇪Belgium🇧🇷Brazil🇧🇸Bahamas🇨🇦Canada🇨🇭Switzerland🇨🇱Chile🇨🇳China🇨🇴Colombia🇨🇷Costa Rica🇨🇿Czech Republic🇩🇪Germany🇩🇰Denmark🇩🇲Dominica🇪🇸Spain🇪🇹Ethiopia🇫🇮Finland🇫🇷France🇬🇧United Kingdom🇭🇰Hong Kong🇮🇩Indonesia🇮🇱Israel🇮🇳India🇮🇹ItalyJersey🇯🇵Japan🇰🇪KenyaKorea, Republic of🇲🇦Morocco🇲🇹Malta🇲🇽Mexico🇲🇾Malaysia🇳🇱Netherlands🇳🇴Norway🇳🇿New Zealand🇵🇪Peru🇵🇭Philippines🇵🇱PolandPuerto Rico🇵🇹Portugal🇵🇾Paraguay🇷🇴RomaniaRussian Federation🇸🇦Saudi Arabia🇸🇪Sweden🇸🇬Singapore🇸🇮Slovenia🇹🇭Thailand🇹🇷TurkeyTaiwan, Province of China🇺🇸United StatesVenezuela, Bolivarian Republic of🇿🇦South Africa