Sinobi Group

Introduction

Sinobi emerged in late June 2025. This ransomware group employs a combination of AES and RSA encryption algorithms to lock victims’ files, appending them with the .SINOBI extension. Upon infection, victims receive a ransom note titled README.txt, instructing them to contact the attackers via a Tor-based chat site to negotiate payment. The note emphasizes that the group is financially motivated, not politically, and offers proof of data decryption and a list of exfiltrated files. Victims are given seven days to initiate communication, with warnings against using third-party recovery tools or rebooting their systems

Summary

Sinobi initiates its attacks through various entry points, including initial access brokers, phishing kits, and exploiting vulnerabilities in remote access systems like Citrix or Fortinet. They may also utilize supply chain compromises to infiltrate target organizations through trusted third parties. The group’s operational patterns closely mirror established threats like RansomHub and ALPHV, drawing inspiration from leaked Conti ransomware methods. Once inside, operators conduct "hands-on-keyboard" intrusions using a mix of custom tools and living-off-the-land techniques. Attackers prioritize privilege escalation and security evasion by creating admin accounts and disabling endpoint protections. Persistence is typically established by configuring legitimate remote access tools to maintain a foothold. A lightweight reconnaissance script is then deployed to automate lateral movement and identify critical domain information and file shares. Before encryption begins, data is exfiltrated to offsite cloud storage using tools like Rclone or WinSCP. The ransomware binary, often disguised with a generic filename, deletes the Recycle Bin and encrypts files with a .SINOBI extension. Finally, ransom notes are dropped in every directory, and the desktop wallpaper is replaced with a demand for payment.

Background and History

Sinobi can be traced back to several group0s in 2022, traces technical lineage link to INC Ransomware from August 2023, whose source code was sold for $300,000 on underground forums in spring 2024. It was then acquired and bought by the Lynx operators in July 2024. Binary analysis reveals 70% function similarity between Lynx and INC implementations, with code overlaps, and desgin choices. Other infomration such as the design of their leak sites suggests that multuple rebrandings have taken place, though both groups currently operate in parallel. The operation is therefore thought to follow standard affiliate revenue share models, with selective vetting through Russian-language forums.

INC activity diminished and a new group called Lynx emerged around the same time. There is no confirmation that Lynx operators purchased INC source code, but Lynx is clearly a successor to INC. Lynx was an active and aggressive threat for about one year, and then scaled back its activities in mid-2025. The group remains a threat, but its activity declined around the time Sinobi emerged in June 2025. Sinobi is widely believed to be a rebrand, successor, or offshoot of Lynx ransomware.

TTPs and Attack Methodology

• Public-facing application exploitation (T1190)
• Managed service provider accounts with domain administrator rights.
• onicWall SSL VPN compromise through CVE-2024-53704 authentication bypass via improper session cookie handling (T1133).

Sinobi gains initial access primarily by abusing valid credentials, usually VPN or RDP logins purchased from initial access brokers or harvested via prior compromise. Sinobi also conducts phishing campaigns to steal credentials or deploy malware and actively exploits vulnerabilities in internet-facing infrastructure, including SonicWall SSL-VPN appliances and other unpatched perimeter devices. In some cases, Sinobi leverages trusted third-party or MSP access to pivot into victim environments.

Sinobi escalates privileges shortly after initial access by abusing built-in Windows administrative capabilities. Sinobi frequently creates new local administrator accounts or elevates existing accounts to ensure unrestricted control over compromised systems.

Hashes and IOCs