Sinobi is a ransomware family and associated extortion operation that emerged in mid-2025 and is widely assessed as a rebrand or close relative of the Lynx ecosystem, with lineage tied to the sale and reuse of INC ransomware source code. It has been described as part of a broader cluster of related ransomware activity derived from the INC codebase, alongside Lynx, which complicates attribution between brands and affiliates.
Sinobi conducts double-extortion intrusions, combining file encryption with data theft and pressure through victim-leak operations. Reported incidents show operators staging exfiltration prior to encryption and deploying the ransomware broadly across Windows domains, including via malicious Group Policy logon scripts. Observed post-compromise activity includes use of remote management tooling for command and control, lateral movement over administrative protocols such as RDP and WinRM, credential access from domain stores, and exfiltration with common attacker utilities before encryption. Encrypted files have been reported to receive a distinctive Sinobi extension.
Initial access has been linked to multiple channels typical of modern ransomware affiliates: compromised credentials obtained through initial access broker activity, phishing, and exploitation of exposed edge infrastructure including VPN, Citrix, Fortinet, and SonicWall appliances. In at least one documented intrusion, operators used a trojanized remote-management agent installed as a SYSTEM auto-start service to maintain covert access for several days before domain-wide ransomware deployment.
Victimology indicates activity against healthcare and specialized healthcare-related organizations, including biotechnology firms, as well as industrial sectors such as manufacturing, construction, renewables, and telecommunications. Public reporting also places Sinobi among active ransomware brands during 2025 and 2026, though its activity level appears to have fluctuated significantly over time.
Sinobi is best characterized as a Windows-focused ransomware strain within a related INC/Lynx lineage, operated through affiliate-style intrusion tradecraft that emphasizes credential abuse, remote administration, lateral movement, data exfiltration, and enterprise-wide encryption.
