sinobi Ransomware
Tracked since Jul 5, 2025
0
victims recorded
0
in the last 30 days
0
CVEs
—
Last activity
Sinobi is a private vetted-affiliate RaaS group that emerged in mid-2025, believed to be a rebrand of the Lynx/INC ransomware lineage, claiming 176 victims by end of 2025 through double-extortion attacks primarily against mid-market US organizations via compromised SonicWall VPN credentials.
Vulnerabilities cited for this group
CVEs associated with the group by ransomware.live. Records not yet published here appear without a link.
No CVE associated with this group in the sources.
Tactics and techniques (MITRE ATT&CK)
Initial Access
T1078 Valid AccountsT1190 Exploit Public-Facing ApplicationT1566 Phishing Execution
T1059.001 Command and Scripting Interpreter: PowerShellT1059.003 Command and Scripting Interpreter: Windows Command ShellT1106 Native APIT1203 Exploitation for Client ExecutionT1569.002 System Services: Service Execution Persistence
T1543.003 Create or Modify System Process: Windows Service Privilege Escalation
T1068 Exploitation for Privilege Escalation Defense Evasion
T1027 Obfuscated Files or InformationT1070 Indicator RemovalT1070.004 Indicator Removal: File DeletionT1562.001 Impair Defenses: Disable or Modify Tools Discovery
T1046 Network Service DiscoveryT1083 File and Directory DiscoveryT1087.002 Account Discovery: Domain Account Lateral Movement
T1021.001 Remote Services: Remote Desktop Protocol Exfiltration
T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage Command and Control
T1573.001 Encrypted Channel: Symmetric Cryptography Impact
T1486 Data Encrypted for ImpactT1489 Service StopT1490 Inhibit System Recovery Resource Development
T1587.001 Develop Capabilities: MalwareT1588.002 Obtain Capabilities: Tool Victims posted on leak sites, according to ransomware.live. Victim names are not displayed. · View on ransomware.live