Sinobi is a ransomware operation that emerged in mid-2025 and is widely assessed as a rebrand of, or very close relative to, the Lynx ransomware ecosystem, with broader lineage tied to the 2024 underground sale of INC ransomware source code. Code and tradecraft overlap reported among INC, Lynx, and Sinobi indicate that Sinobi belongs to the same evolving criminal cluster rather than an entirely distinct lineage.
Sinobi is used in double-extortion attacks, stealing data prior to encryption and then pressuring victims through extortion. Reported cryptographic implementation includes Curve25519 with AES-128-CTR, and encrypted files have been associated with a distinctive Sinobi-branded extension. The operation has been observed targeting Windows environments and is also linked through lineage reporting to Linux and ESXi-capable ransomware development inherited from the INC codebase, although direct Sinobi-specific cross-platform deployment details are less consistently documented.
Initial access associated with Sinobi includes credentials obtained through initial access broker activity, phishing, and exploitation of exposed edge infrastructure such as VPN, Citrix, Fortinet, and SonicWall appliances. One reporting stream specifically linked Sinobi deployment to compromised SonicWall VPN access. Victim access has also been obtained through compromised third-party provider credentials. Sector reporting shows notable activity against healthcare, biotechnology, specialized healthcare companies, manufacturing, construction, telecommunications, and other industrial organizations, with multiple references to healthcare-focused operations in 2025. Public victim-count reporting indicates Sinobi became one of the more active ransomware brands during late 2025, though activity levels fluctuated sharply over time.
Sinobi is best understood as part of the broader post-INC fragmentation of the ransomware ecosystem, where leaked or sold source code, affiliate migration, and rebranding have complicated attribution. Its operational profile aligns with modern ransomware crews that combine credential-driven intrusion, exploitation of perimeter appliances, data theft, and encryption-based extortion against enterprises with low tolerance for downtime.
