Sinobi ransomware

Sinobi is an affiliate-run (RaaS) ransomware brand that surfaced in mid-2025 and runs a double-extortion leak site. Affected files keep their original names with .SINOBI tacked on the end (so report.xlsx becomes report.xlsx.SINOBI ), a README.txt note is left in each encrypted folder, and the desktop background is swapped for an image carrying the same demand. The note introduces itself as the "Sinobi Group", gives the victim seven days to open a Tor chat using a per-victim ID, offers a test decryption plus a list of stolen files, and lists a clearnet mirror for readers who cannot reach Tor. Most claimed victims are mid-sized US companies in manufacturing, construction, healthcare, finance and professional services. Responders have seen affiliates log in through SonicWall SSL VPN appliances with stolen or MSP-held credentials, add accounts, remove security tooling and copy data out with RClone before launching the encryptor, which pairs Curve25519 with AES-128 and wipes shadow copies. Sinobi is widely assessed as a rebrand or offshoot of Lynx, itself derived from INC ransomware code; the two brands have been seen running in parallel.

File extensions: .SINOBI

Ransom note filenames: README.txt

Decryptor: No public decryptor was found. Checked 2026-10-28.

Data exfiltration risk: Confirmed — Incident responders observed affiliates copying data to external storage with RClone before encryption, and the group publishes victims on a Tor leak site.

Systems typically targeted: Windows servers and workstations

Do this first: Reset every SonicWall SSL VPN and MSP-held account, then hunt for rclone.exe executions and new local admin accounts before restoring anything.