Sinobi Ransomware: INC and Lynx Code Lineage, 176+ Victims, Manufacturing Focus

Overview

Sinobi is a ransomware-as-a-service operation that emerged in late June 2025. In its first six months, the group claimed 176 attacks across 19 countries, establishing itself as one of the more operationally mature new entrants of 2025. The group targets mid-sized to large enterprises with a concentration in manufacturing, construction, and financial services — and it has continued to operate into 2026 with consistent victim volumes.

Threat intelligence assessments from Blackpoint Cyber, SOCRadar, and Halcyon attribute Russian or Eastern European origins to the Sinobi operators, based on linguistic artifacts in ransom notes and negotiation communications, activity timing patterns, and the near-universal avoidance of organisations in CIS countries.

Code Lineage and Attribution

The most analytically significant aspect of Sinobi is its likely lineage from INC Ransom, and by extension its similarities to Lynx ransomware. The connection has two components.

Shared code base: Threat intelligence analysts at multiple firms identified structural and implementation similarities between the Sinobi encryptor and the INC Ransom codebase. INC Ransom’s source code was publicly listed for sale on underground forums in May 2024, priced at $300,000 USD. Sinobi’s encryptor is assessed to have originated from that purchase or a related source — the crypto implementation, string constants, and behavioural patterns are consistent with INC Ransom ancestry.

Lynx connection: Lynx ransomware, which also exhibits INC Ransom lineage, has overlapping operational patterns with Sinobi including target sector focus and RDP-heavy lateral movement. Some analysts treat Sinobi, Lynx, and INC Ransom as a cluster sharing code origin rather than three entirely independent operations, though the affiliate relationships appear distinct.

The implication for defenders: TTPs, indicators, and detection logic developed for INC Ransom and Lynx incidents apply meaningfully to Sinobi intrusions.

Operational Model

Sinobi operates as a semi-private RaaS. The group does not openly recruit affiliates through forums — it maintains a curated affiliate base of known, vetted operators. This contrasts with fully open RaaS models (such as those run by RansomHub) and allows Sinobi to maintain tighter operational security and more consistent intrusion quality.

The financial split terms have not been publicly confirmed, but the typical RaaS affiliate split is 80/20 (affiliate/core team). Sinobi’s victim count, if accurate, would represent a meaningful revenue stream even at mid-market ransom demands.

The group operates a data leak site for double extortion. Victims who do not pay face publication of exfiltrated data. The DLS has been active since the group’s launch with consistent updates.

Initial Access

Sinobi operators gain initial access through compromised credentials for remote access services. The primary access vectors observed are:

• VPN gateway credential abuse: Targeting perimeter VPN appliances where credentials are obtained from credential markets, phishing campaigns targeting remote-work employees, or exploitation of publicly known CVEs in VPN software
• RDP brute-forcing and credential stuffing: Where RDP is internet-exposed, Sinobi has leveraged credential sets purchased from access brokers or obtained via stealer logs

The group has not been publicly associated with zero-day exploitation. Initial access methodology appears opportunistic rather than targeted — organisations with credential hygiene issues and exposed remote access surface are the primary victims.

Lateral Movement and Pre-Encryption Activity

Sinobi uses RDP and SMB share mounts as the primary lateral movement mechanisms. After gaining initial access, operators conduct reconnaissance under the context of the compromised user account before pivoting to created accounts when credential escalation is achieved.

Common activity observed in Sinobi incidents:

• Creation of new local administrator accounts for persistence
• Use of built-in Windows tools for reconnaissance (net user, net group, nltest, dsquery)
• Disabling or tampering with backup services (Volume Shadow Copy deletion via vssadmin)
• Data staging and exfiltration to attacker-controlled infrastructure prior to encryption

The group does not appear to dwell extensively — observed dwell times in Sinobi intrusions range from days to roughly two weeks, consistent with a group prioritising operational velocity over prolonged persistence.

Encryption Implementation

Sinobi’s encryptor uses Curve25519 (elliptic curve Diffie-Hellman) for key exchange combined with AES-128-CTR for symmetric encryption. The Curve25519 implementation provides forward secrecy — each victim’s decryption key is generated using a key exchange process where the victim-side private key is never stored on disk in recoverable form. This makes recovery without paying impractical in the absence of a Sinobi operator key material compromise.

Sinobi targets Windows and Linux environments. A VMware ESXi encryptor has been observed, consistent with the group’s enterprise targeting profile — organisations with virtualised server estates are efficiently impacted by ESXi-level encryption.

Encrypted files receive the .sinobi extension, and a ransom note is deposited in each affected directory.

Victim Profile

• Primary sectors: Manufacturing and industrial production (largest share), followed by construction, engineering, financial services, healthcare, and education
• Geographic concentration: United States accounts for the majority of confirmed victims, with additional activity across Western Europe, Australia, and Canada
• Revenue range: Victims primarily fall in the £10–50 million annual revenue band, though larger enterprises have been affected
• Target avoidance: CIS member states, consistent with Russia/Eastern Europe operator assessment

Indicators of Compromise (IOCs)

Sinobi IOCs are maintained in threat intelligence platforms including Halcyon’s threat group database and ransomware.live. Key indicators:

• File extension: .sinobi on encrypted files
• Ransom note: RESTORE-FILES.txt (filename varies across versions)
• Registry persistence entries (observed variants): scheduled tasks under HKLM for persistence during dwell phase
• Network indicators: Tor .onion address for negotiation portal (rotated per victim)

Recommended Actions

For all organisations:

• Inventory internet-exposed remote access: enumerate all VPN, RDP, and other remote access infrastructure. Port scan your own perimeter. If RDP (TCP 3389) is internet-routable, restrict it immediately to specific IP ranges or remove it behind a VPN/ZTNA gateway.
• Enforce MFA on all remote access. VPN credential abuse is the primary Sinobi access vector — MFA enforcement would block the initial access step entirely.
• Monitor for new local administrator account creation via SIEM/EDR alerting. net user /add and net localgroup administrators /add are high-confidence indicators of post-compromise activity.
• Protect backups: verify that backup destinations are inaccessible from production environments and that VSS snapshots are monitored for deletion events.

For manufacturing and construction sector organisations (primary Sinobi targets):

• OT network segmentation: ensure that manufacturing execution systems and OT environments are not reachable from compromised IT infrastructure
• Vendor access review: third-party remote access to plant systems is a common lateral movement path in manufacturing sector intrusions — audit and restrict it