Sinobi
A double extortion ransomware operation first seen in June 2025, mostly hitting mid-sized US organisations. Vendors suspect a link to Lynx and INC through shared code, but the relationship is not settled.
Threat actor profile. Last reviewed 3 November 2026.
Why It Matters
Sinobi's lineage is the question most reports raise. Halcyon lists it as a suspected rebrand or evolution of Lynx, and says both reportedly run in parallel.3 Hive Pro makes a medium-confidence assessment of a rebrand or successor, based on code and leak site overlaps.2 Blackpoint says it is unclear whether the groups work together or run separately on shared code.1
The target profile is specific. Blackpoint and Halcyon describe organisations with annual revenue of $10 to $50 million, with manufacturing first, followed by construction and healthcare.1,3
Trusted access is a recurring theme. Blackpoint describes one case where an SSL VPN was reached with a managed service provider account mapped to a domain admin account.1 The sources reviewed focus on the US and do not establish a UK link.3
An account held by your IT provider can carry a lot of power. We would review what third-party accounts can reach, along with VPN patching.
How It Attacks
Combined from Blackpoint1 and Halcyon.3 Affiliates vary, so this is a typical pattern and not a fixed script.
- 1
Reach the VPN
Exploits edge devices such as SonicWall VPNs, or logs in with compromised accounts, including one reported managed service provider account.
- 2
Add Accounts
Creates new accounts and domain administrators.
- 3
Weaken Defences
Attempts to uninstall security software and deletes shadow copies.
- 4
Harvest Credentials
Dumps LSASS with ProcDump, according to Halcyon.
- 5
Move Laterally
Uses RDP, SMB, DCOM and WMI.
- 6
Steal and Encrypt
Exfiltrates with Rclone or WinSCP, encrypts files, then threatens a leak.
Key Techniques
ATT&CK v20 has no group entry for Sinobi. Mapping draws on Hive Pro2 and Blackpoint.1
| ID | Technique | Tactic | What It Looks Like |
|---|---|---|---|
| T1133 | External Remote Services | Initial Access | Reaches networks through SSL VPNs. |
| T1190 | Exploit Public-Facing Application | Initial Access | Exploits edge devices. |
| T1078.002 | Domain Accounts | Initial Access | Uses compromised domain and provider accounts. |
| T1685 | Disable or Modify Tools | Defence Impairment | Removes or disables security software. |
| T1003 | OS Credential Dumping | Credential Access | Dumps credentials from LSASS. |
| T1021.001 | Remote Desktop Protocol | Lateral Movement | Moves over RDP. |
| T1567.002 | Exfiltration to Cloud Storage | Exfiltration | Sends data to cloud storage. |
| T1490 | Inhibit System Recovery | Impact | Deletes shadow copies. |
| T1486 | Data Encrypted for Impact | Impact | Encrypts files. |
Tools Observed
Remote Access
Credential Theft
Data Theft
From Blackpoint1 and Halcyon.3 These are legitimate tools, so check whether use is approved and expected.
Vulnerabilities
These are the CVEs vendors tie to Sinobi. Patching alone may not be enough if credentials were already taken.
Defences That Matter
Patch and Harden VPNs
- Patch SonicWall devices against the listed CVEs.4
- Require MFA on all VPN access.
- Reset VPN credentials after patching if exposure is possible.
Limit Third-Party Accounts
- Avoid giving provider accounts domain admin rights, given the reported case.1
- Review and monitor what those accounts do.
Detect Tampering
- Alert on removal of EDR and shadow copy deletion.
- Monitor for outbound transfers with Rclone.
What Could Your IT Provider's Account Reach?
We can review your VPN and third-party access against the methods in this profile and help you close the gaps.
Sources
- Blackpoint Cyber: Sinobi Ransomware threat profile, 23 February 2026
- Hive Pro: Sinobi Ransomware: A Fast-Rising Mid-Market Threat to Watch in 2026, 16 June 2026
- Halcyon: Sinobi threat group profile, updated 27 July 2026
- CISA Known Exploited Vulnerabilities catalogue, version 2026.10.30
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK terms of use.