Search Ransomware Intelligence
Jump to a group, country, industry or search victims.
Sinobi
As of Oct 19, 2026, Sinobi has listed 276 confirmed victims on its leak site since Jul 2, 2025, 0.9% of all victims tracked by Brandefense. Its most targeted country is United States (74.6% of its victims) and its most targeted sector is Technology.
Sinobi is a private vetted-affiliate RaaS group that emerged in mid-2025, believed to be a rebrand of the Lynx/INC ransomware lineage, claiming 176 victims by end of 2025 through double-extortion attacks primarily against mid-market US organizations via compromised SonicWall VPN credentials.
Follow and IOC feeds are part of the Brandefense platform.
- Confirmed Victims
- 276
- Rank By Victims
- #26
- Last Leak-Site Post
- May 5, 2026
- Top Country
- United States
- Top Sector
- Technology
Victims Posted Per Month.
| Month | Confirmed victims |
|---|---|
| May 2026 | 6 |
| June 2026 | 0 |
| July 2026 | 0 |
| August 2026 | 0 |
| September 2026 | 0 |
| October 2026 (month in progress) | 0 |
| Month | Confirmed victims |
|---|---|
| November 2025 | 21 |
| December 2025 | 54 |
| January 2026 | 58 |
| February 2026 | 18 |
| March 2026 | 7 |
| April 2026 | 0 |
| May 2026 | 6 |
| June 2026 | 0 |
| July 2026 | 0 |
| August 2026 | 0 |
| September 2026 | 0 |
| October 2026 (month in progress) | 0 |
| Month | Confirmed victims |
|---|---|
| July 2025 | 8 |
| August 2025 | 32 |
| September 2025 | 4 |
| October 2025 | 68 |
| November 2025 | 21 |
| December 2025 | 54 |
| January 2026 | 58 |
| February 2026 | 18 |
| March 2026 | 7 |
| April 2026 | 0 |
| May 2026 | 6 |
| June 2026 | 0 |
| July 2026 | 0 |
| August 2026 | 0 |
| September 2026 | 0 |
| October 2026 (month in progress) | 0 |
Latest Sinobi Victims.
Search all 276 →| Victim | Country | Industry | Data claimed | Posted |
|---|---|---|---|---|
| Neurotrials Research Inc neurotrials.com | USUnited States | Consulting | 180 GB | |
| Scales and Associates Inc scalesassoc.com | USUnited States | Consulting | 85 GB | |
| Unre3d 2017.as | SESweden | Unknown | 12 GB | |
| Bay State Land Services baystatelandservices.com | USUnited States | Construction | Not stated | |
| Celeris Networks celerisnetworks.com | USUnited States | Technology | Not stated | |
| Positiwise Infotech Pvt positiwise.com | INIndia | Technology | 100 GB |
How They Operate.
Sinobi's threat actor profile lists 19 ATT&CK techniques, 24 malware and tools, with its targets and related actors.
TTPs, CVEs and malware →Who Sinobi Targets.
History.
First seen in Brandefense data
First confirmed victim listed on its leak site
Busiest month on record: 68 confirmed victims
Most recent leak-site post
Get Real-Time Alerts, IOC Feeds And Takedowns.
The Brandefense platform watches every leak site for your company, vendors and executives, and acts on what it finds.