Ransomware group profile · #27 by claimed victims

Sinobi ransomware

Sinobi is a private vetted-affiliate RaaS group that emerged in mid-2025, believed to be a rebrand of the Lynx/INC ransomware lineage, claiming 176 victims by end of 2025 through double-extortion attacks primarily against mid-market US organizations via compromised SonicWall VPN credentials.

Active First seen Jul 2025

274Victims claimed on leak sites

0Victims in the last 30 days

0Victims in the last 90 days

26Countries hit

21Leak-site URLs tracked, 0 online

8 May 2026Latest claim recorded

Victimology

Who Sinobi claims to have breached, from 274 leak-site posts recorded by VULONE.

Claims per month last 12 months

Top sectors

Manufacturing65

Professional Services47

Healthcare38

Technology32

Retail & E-Commerce24

Financial Services15

Hospitality10

Agriculture and Food Production9

Top countries

United States205

India12

United Kingdom10

Canada7

Italy5

France3

Spain3

Denmark2

Latest claimed victims 12 most recent

Victim	Sector	Country	Claimed
Neurotrials Research Inc neurotrials.com	Healthcare	US	8 May 2026
Scales and Associates Inc scalesassoc.com	Professional Services	US	6 May 2026
Positiwise Infotech Pvt	Technology	IN	5 May 2026
Celeris Networks	Technology	—	5 May 2026
Bay State Land Services	Professional Services	US	5 May 2026
Unre3d	Not Found	—	5 May 2026
Elgi Electric & Industries elgielectric.com	Manufacturing	IN	19 Mar 2026
Amerinational Management Services (AMS) ourams.com	Professional Services	US	19 Mar 2026
Summa Energy summaenergy.com	Energy & Utilities	US	18 Mar 2026
Interpack Northwest interpacknorthwest.com	Agriculture and Food Production	US	18 Mar 2026
Eco Sound Builders ecosoundbuilders.com	Manufacturing	US	17 Mar 2026
McAfee Tool & Die mcafeetool.com	Manufacturing	US	17 Mar 2026

All 274 Sinobi victims, searchable

Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.

Start free Sign in

Tactics, techniques and procedures

ATT&CK technique mapping for Sinobi is in progress. Victimology, infrastructure status and leak-site tracking are live above.

Indicators, detections and the full playbook

Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.

See full IOCs

Frequently asked

Is Sinobi ransomware still active?

Sinobi is tracked as active. The most recent leak-site claim VULONE recorded is dated 8 May 2026.

How many victims has Sinobi claimed?

VULONE has recorded 274 leak-site victim claims attributed to Sinobi since July 2025, across 26 countries and 14 sectors.

Which industries does Sinobi target?

The sectors most often named on the Sinobi leak site are Manufacturing, Professional Services, Healthcare.

Which countries are most affected by Sinobi?

Most Sinobi victims recorded by VULONE are located in United States, India, United Kingdom.

Where does VULONE get Sinobi victim data?

Claims are collected continuously from the group's own leak sites and cross-checked with ransomware.live and RansomLook. A claim is the group's assertion, not a confirmed breach.

Other ransomware groups

Victim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 16 September 2026. Questions or corrections: [email protected].