Japan

sinobi

Sinobi is a private vetted-affiliate RaaS group that emerged in mid-2025, believed to be a rebrand of the Lynx/INC ransomware lineage, claiming 176 victims by end of 2025 through double-extortion attacks primarily against mid-market US organizations via compromised SonicWall VPN credentials.

First seen 2025-03-24 · Last seen 2026-05-06 · 1 Japan claims

Tactics: Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Discovery, Lateral Movement, Exfiltration, Command and Control, Impact, Resource Development

CVEs named by the source: CVE-2025-61882, CVE-2024-53704, CVE-2024-40766

Cached from ransomware.live. 2026-10-01 PT. Leak sites are not linked.