Ransomware needs a way in. Stolen credentials are the cheapest one.
sinobi Ransomware Group
Ransomware group profile
222Victims
RussiaSource country
72Impact score
Description
Sinobi is a financially motivated threat group that employs a hybrid Ransomware-as-a-Service (RaaS) model. Emerging in mid-2025, it is characterized by a disciplined approach to attacks, extensive operational security, and a focus on stealth through living-off-the-land techniques.
Key insights
- •Utilizes a double-extortion model, threatening public disclosure of stolen data if ransom demands are not met.
- •Initial access is commonly gained through stolen VPN or Remote Desktop Protocol (RDP) credentials, often exploiting known vulnerabilities.
- •Employs sophisticated evasion tactics, including disabling endpoint protection, modifying firewall configurations, and data exfiltration using legitimate tools like Rclone.
- •Has been linked to past groups like Lynx and INC due to code overlaps and operational similarities.
- •Targets a diverse range of sectors, with notable attacks on organizations in healthcare and manufacturing.
Threat Level & Status Breakdown
For sinobi · Based on incidents in selected period
2.6threat level
Aggressiveness5/ 10
Lethality0/ 10
Criticality2.8/ 10
Status Breakdown
Claimed100.0%222
First seenSep 2025
Last seenMay 2026
Avg ransom—
Payment rate—
Statusactive
Sophistication0
Last updatedSep 19, 2026
Recent activity
Monthly attack count for sinobi in the selected period
222Total attacks
57peak in Oct
27.8avg / month
↑ 4 vs first month
Intelligence
IOCs, YARA/Sigma rules, and related families for sinobi
- fb14aae2ed93a7ddfa718f433f585735
- e14ba0fb92e16bb7db3b1efac4b13aee178542c6994543e7535d8efaa589870c
- a768244ca664349a6d1af84a712083c0
- 39300863bcaad71e5d4efc9a1cae118440aa778f
- c3804d1329b55a37bfa2f835e1e9bbc7bdb2b260f8e3627c06e02c9f52685d44
- 7eec7d07587112777016e5742c0d002d7e64a3e1fe7bde82fed8f65e3663456a
- e1c371c7c39c16d208bcbaa5b5d0714df696e6ef68b95a880673a904527c8b96
- 82ed942a52cdcf120a8919730e00ba37619661a3
- 6bc8e3505d9f51368ddf323acb6abc49
- 16f83f056177c4ec24c7e99d01ca9d9d6713bd0497eeedb777a3ffefa99c97f0
- 31c3574456573c89d444478772597db40f075e25c67b8de39926d2faa63ca1d8
- edd1be036b00de9a2a09a03d8e0e8ec392c5ee7b
- dd475afd948cc22caa2a0f934d0aec52
- 94f73b5dc06ba6705fcef3e759413a747049c2949a0c2e44afc03b2f9989cf73
- 08759d9ea2712d693891c870bbebbde3
- d4919a7402d7ae02516589fbdfb3cc436749544052843a37b5d36ac4b7385b18
- 00454046c6be47839226fc55da5bc492e5d4f99c
- e06520c65bf27d9110d68ecc0de0e0824c3a99be080ead1a5b5be8fd2a26d12d
- 265a8e89464e32b22553ef16edbab703da7176a7
- 03dd0efa84d145d7d4ed8e240267e5c5
- 6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141
- 9c35444bdfddbbe92efb045ba93c7fab
- deea481121129d4779195e93fdc39ae62fecb168fd5a384d0ccf8082f06092e5
- dcb0e301261b81e5888c0ba6a8ce887b8ed52e5d
- 82cd0af26bc1e9e3b0bfcfe6c61cf467992367a31d87e6bd7e2efa8e9fecbb25
- 1b2a1e41a7f65b8d9008aa631f113cef36577e912c13f223ba8834bbefa4bd14
- 8bb8c6e72d20e9b07bb55e0b0d168efe99d0088122131ae96d13fa01d3325a17
- 5f0253f959d65c45a11b7436301ee5a851266614f811c753231d684eb5083782
- 2149a070e76f4ccabd67228f754768dc
- f488861f8d3d013c3eef88983de8f5f37bb014ae13dc13007b26ebbd559e356e
- e46bde83b8a3a7492fc79c22b337950fc49843a42020c41c615b24579c0c3251
- e38d4140fce467bfd145a8f6299fc76b8851a62555b5c0f825b9a2200f85017c
- 5fff877789223fa9810a365dfdeafe982c92f346ecd20e003319c3067becd8ba
- 549a1ae688edfcb2e7a254ac3aded866b378b2e829f1bb8af42276b902f475e6
- 454e398869e189874c796133f68a837c9b7f2190b949a8222453884f84cf4a1b
- 3dba9ba8e265faefce024960b69c1f472ab7a898e7c224145740f1886d97119f
- 331d136101b286c2f7198fd41e5018fcadef720ca0e74b282c1a44310a792e7f
- 15e5bf0082fbb1036d39fc279293f0799f2ab5b2b0af47d9f3c3fdc4aa93de67
- 13ca66d08c04e5be77582f5dd4ab6ca28563b6d9
- b2398a81b5467f75f476a107027b3259
- 7f37351979c249417cb180b4ede0ed17e5fe2a1f08add4d72606b589f8fdb245
- 5cc212f84d2bf3fbab165aaf09b16e00fcf2f1ccd880d24b14404c53dcdbf241
- 60aeb9f7bccf377ff02ed64783e66a62c0f976878d9729b067bc7e5b0b9da9d6
- 8bd32c26db7ebd8d0764a8292d536a76fd8b1d5e
- 765508aa2ec6a1b73a76a23f4fa559d32355622748c91a46ed7b315eae2ee60a
- d26bfb0147f60dc6500a9298d521ee67b49daaf4b8f8be54e7cc8fd86a597570
- 266bab046cf4b7ddd9655416179f07bcab59d409
- 32827e9bdf630d974531c2f715d2426c
- 97aebda5482899fef84a24e456bff055acaa47e5ab4029f768d9e0c62a660ce2
- ec5366d5b9e6ef094c1583170c85f4fe4f38e1e2
- 2de9c6065dd5c0bcd67cc4d90c10788a
- a700329f65470db3b7489005218f3937
- 3511a9aa2acae34aaadd03073fe09e39
- 02d75d08c89c100685ccb5a72605a22a3cf2460a
- 90e46e89fec2108a1cb4850bb33e3563e92a14d04e1e613ac8c9311f152d294c
- eae09889399fe4fb8e78b114dba0527de913d12fb1802944a88ed136e3e90577
- e7288f4e4cf20e219a0394d5dabb82b6
- fcc3cbe8bfe18f08eadda3acd4258369
- 589d9480fbfec2d8e61638eb0b537183d0f9977411fd1d2c0f8eb611feebe880
- be3d939747ad05764b2d9dd461697093
- c192ef6c4143b8df43ea7855224e77ecd4f34080
- ea721240c14e3d14f8d88e0020880448c6c602f1180a1e5dbe40871cfeedcc22
- acce811c4fc2a6e3fddd4231e386f1648ca44f039d2d275316bc0a0fc96e0af4
- 31800380c359143ae82c4f9011eee653dd22443d03d6a499148203bbfc275502
- 70331fdf528f4f5b75b5e30427e379bc88aa05b4
- 16bad42a397db2e075e09b5b9dd53aaa67b495a4
- eb37c4fcfc00d3813ab94f4d59378b47
- dce9ad6317ce147f1f3f74bc93d9252a
- ff5da8f0330a4c581c37284c74aae2683c007dc6e406e1e2e6803e7bb398b77b
- f6a01d0246ce31faf6938ea488086d4358505405a4ef5c5faa482e79e92cb347
- dc9938f51150d13a69fc25f3f19052eacb1bf0a086fd5cf39762501fb3ddd7da
- d65120291dee76c694f8bea54841f7f68329b499b28f4aee5ea5c9369a7432cb
- bf8c45e5aa9551a17eefbd1d179422c32b4309c47ee9a3f315bb80ed6d4f7efc
- 8d1a22c430252f29611766b8e4a82af0fba60d609246463466b384d6d4793df4
- 6bf155b269d452f3c3b62832b27bbebe4da436e228dbf521155b1d5989e3743f
- 24f6c0ca39b2a5593086ff56d818ddfbde121f8e44d54faa762e510397dc9db7
- 1d10d8f5a420d0e4683b4cb40bcf0c984d1e7ea1f3b4442a00a525584632ac11
- 1898d056463284d849801cbdea6a3dec6c9f568f01569912c3868a5eea9a5449
- abbd165dab5580e1905e87a8ac5139a4232fd908
- 6d28d0ad4c7192bf8fccd1be1e10d5d9
- 4f04f2c98ae0dccf842bd1ab0971b5bd39a7f97a
- 0ed1f07b1eec40b0452316c842ab3182
- 81b41cf5effc3b259436d9864e8e2db703ad3743
- a9bc032353bd246ba50af1b8d4849bfd
- 9dcfffc9f252189a4ad9d144ccdc8048a4382828
- ec37a6c4866b7324fce2f11b0e89c4c2
- 6c6f13872bb7d18692bfc04757302f98d951217b
- ce0a95fb73a901a2e3a449e62850f4e5
- 5b63a1dc187670723d02b4b675255a20a70d10b8
- ef88cf8a71b4dfca2c46cc3fedf70246
- 073bb9994c0688aa092ce81b077199088c9353ce
- 78d359a87ae75ece08976e8b14d877fe
- 2c1dc7f4f97ea6a9e4d0a2e69aea849655bfc9d5
- f155e31fdde0c66200b717335038faee161c2812
- 7ff4e2df39af1f1b8e726e674e69fca7c280f06a
- 85befc3111bc28dc9715570a068412ba
- a088e9ba0a9d8f33bfd8f6294188c58eb01b70d0
- 03f94497683ba6db6ba98cbe8070684eb9ebcd13
- efbeeb7c816919d729b74a2ecb909bb6
- 44af7a778a0089836625b10df1ae91c99a984170
- 66b4fe7c167799a53ec793f131a7e387216cc813
- 914ff51fb60247cf13897b1bc950a190
- 6f9e1371427be15a840c2de5eb1719a466af2016
- bd91d786841f5259430c1c90b454d9f8bf510186fe4d32a0998bd9b5a7916467
- 31f94910c9e23ca777f589fe7d3d708e4f88c1b6a7518fdf8c55346865dd35fe
- bc0739e209d086dae2e0ed40bbf9bbf1
- e020eeb1b70a144265775693591164b316e34071
- e6ec7749e3d0f750fa53b5a7619d1e5af57673d236338b3a020d0f534ec5c15d
- d213bccd00f98d8af608186035bc8bf814e13364
- 7ee443b0530bb9fe4c36c0faafdeb6bc
- a06a9bdcd93b52481162f4f65a2d6c2e
- 36706fc47007cb10b2ea12ecc1cd133bfeacde09
- 7f34666025abf6463c84f4dfde8bfdcdb9dfbe6f3e63ed3e0db0758a2ea4d32d
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for sinobi
CVE-2024-40766
Defense Evasion
T1070
Indicator Removal
T1562.001
Disable or Modify Tools
Execution
T1059.001
PowerShell
Impact
T1486
Data Encrypted for Impact
T1490
Inhibit System Recovery
Lateral Movement
T1021.001
Remote Desktop Protocol
Persistence
T1543.003_1
Windows Service
Victims(200)
| Company | Country | Status | Discovered | |
|---|---|---|---|---|
| NeuroTrials Research | United States | Claimed | 4 months ago | |
| Scales & Associates, Inc. | United States | Claimed | 5 months ago | |
| Unre3d | China | Claimed | 5 months ago | |
| Bay State Land Services Inc | United States | Claimed | 5 months ago | |
| Celeris Networks | United States | Claimed | 5 months ago | |
| Positiwise Infotech Pvt | India | Claimed | 5 months ago | |
| Amerinational Management Services, Inc. | United States | Claimed | 6 months ago | |
| ELGI Electric | India | Claimed | 6 months ago | |
| Interpack Northwest | United States | Claimed | 6 months ago | |
| Summa Energy | United States | Claimed | 6 months ago | |
| Toledo Engineering Co., Inc. | United States | Claimed | 6 months ago | |
| McAfee Tool & Die, Inc. | United States | Claimed | 6 months ago | |
| EcoSound Builders, LLC | United States | Claimed | 6 months ago | |
| Graymatter | United Kingdom | Claimed | 7 months ago | |
| Iblesoft Inc | United States | Claimed | 7 months ago | |
| Mayfair Hotels & Resorts | India | Claimed | 7 months ago | |
| Gentegra | United States | Claimed | 7 months ago | |
| Electriduct | United States | Claimed | 7 months ago | |
| Saltech Systems | United States | Claimed | 7 months ago | |
| Sundher Group | Canada | Claimed | 7 months ago |
United StatesProfessional Servicesourams.com
Claimed
6 months agoPage 1 of 10
Affected countries(56)
Countries where this group has been reported to target or leak victims.
🇦🇪United Arab Emirates🇦🇷Argentina🇦🇹Austria🇦🇺Australia🇧🇪Belgium🇧🇷Brazil🇧🇸Bahamas🇨🇦Canada🇨🇭Switzerland🇨🇱Chile🇨🇳China🇨🇴Colombia🇨🇷Costa Rica🇨🇿Czech Republic🇩🇪Germany🇩🇰Denmark🇩🇲Dominica🇪🇸Spain🇪🇹Ethiopia🇫🇮Finland🇫🇷France🇬🇧United Kingdom🇭🇰Hong Kong🇮🇩Indonesia🇮🇱Israel🇮🇳India🇮🇹ItalyJersey🇯🇵Japan🇰🇪KenyaKorea, Republic of🇲🇦Morocco🇲🇹Malta🇲🇽Mexico🇲🇾Malaysia🇳🇱Netherlands🇳🇴Norway🇳🇿New Zealand🇵🇪Peru🇵🇭Philippines🇵🇱PolandPuerto Rico🇵🇹Portugal🇵🇾Paraguay🇷🇴RomaniaRussian Federation🇸🇦Saudi Arabia🇸🇪Sweden🇸🇬Singapore🇸🇮Slovenia🇹🇭Thailand🇹🇷TurkeyTaiwan, Province of China🇺🇸United StatesVenezuela, Bolivarian Republic of🇿🇦South Africa