sinobi Ransomware
Monitorado desde 05/07/2025
0
vítimas registradas
0
nos últimos 30 dias
0
CVEs
—
Última atividade
Sinobi is a private vetted-affiliate RaaS group that emerged in mid-2025, believed to be a rebrand of the Lynx/INC ransomware lineage, claiming 176 victims by end of 2025 through double-extortion attacks primarily against mid-market US organizations via compromised SonicWall VPN credentials.
Vulnerabilidades citadas para este grupo
CVEs associadas ao grupo pelo ransomware.live. Fichas ainda não publicadas aparecem sem link.
Nenhuma CVE associada a este grupo nas fontes.
Táticas e técnicas (MITRE ATT&CK)
Initial Access
T1078 Valid AccountsT1190 Exploit Public-Facing ApplicationT1566 Phishing Execution
T1059.001 Command and Scripting Interpreter: PowerShellT1059.003 Command and Scripting Interpreter: Windows Command ShellT1106 Native APIT1203 Exploitation for Client ExecutionT1569.002 System Services: Service Execution Persistence
T1543.003 Create or Modify System Process: Windows Service Privilege Escalation
T1068 Exploitation for Privilege Escalation Defense Evasion
T1027 Obfuscated Files or InformationT1070 Indicator RemovalT1070.004 Indicator Removal: File DeletionT1562.001 Impair Defenses: Disable or Modify Tools Discovery
T1046 Network Service DiscoveryT1083 File and Directory DiscoveryT1087.002 Account Discovery: Domain Account Lateral Movement
T1021.001 Remote Services: Remote Desktop Protocol Exfiltration
T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage Command and Control
T1573.001 Encrypted Channel: Symmetric Cryptography Impact
T1486 Data Encrypted for ImpactT1489 Service StopT1490 Inhibit System Recovery Resource Development
T1587.001 Develop Capabilities: MalwareT1588.002 Obtain Capabilities: Tool Vítimas divulgadas em sites de vazamento, segundo o ransomware.live. Não exibimos nomes de vítimas. · Ver no ransomware.live