Loading threat actor…
Sinobi is a financially motivated ransomware operation active by 2025 and 2026, also referred to as Sinobi Group and Sinobi ransomware operators. It conducts encryption-based, double-extortion attacks, stealing data before or alongside encrypting victim environments and using a dedicated leak site to pressure victims through threatened or actual publication of stolen material. Sinobi has targeted healthcare organizations, including specialized healthcare and biotechnology firms, and has also targeted US mid-market manufacturing and construction organizations. Reported victims include organizations in the United States and India. In a documented 2026 intrusion, Sinobi used a trojanized MeshAgent remote-management binary for command and control, installed it as a SYSTEM-level auto-start service, and maintained access before ransomware deployment. The operators obtained domain credentials from the Active Directory credential store, moved laterally using RDP and WinRM, staged data using Rclone, and deployed ransomware domain-wide through a malicious Group Policy logon script. Sinobi has also been observed using compromised SonicWall SSL VPN credentials for initial access. The group has been assessed as using ransomware strains related to the INC Ransom codebase, although the precise operational relationship remains unconfirmed.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
22 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
3 CVEs this actor has used in observed campaigns. 3 of them exploited in the wild.
CVE-2014-8361 9.3 Realtek SDK, IoT Devices, Network Equipment Warlock, Sinobi, Beast Link
Observed access vectors included VPN gateways and Remote Desktop Protocol accounts. In parallel, the intrusion showed exploitation of known vulnerabilities such as CVE-2024-53704 affecting SonicWall SSL VPN authentication and CVE-2024-40766 related to improper access control.
Observed access vectors included VPN gateways and Remote Desktop Protocol accounts. In parallel, the intrusion showed exploitation of known vulnerabilities such as CVE-2024-53704 affecting SonicWall SSL VPN authentication and CVE-2024-40766 related to improper access control.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as another Japanese-themed ransomware group for comparison/background.
Mentioned only as a declining group in quarterly rankings.
Ransomware operators using a trojanized MeshAgent binary for covert backdoor access, then moving laterally and deploying ransomware domain-wide via malicious Group Policy Object logon scripts, with observed data exfiltration staging.
Named as a spin-off related to INC in the article, but no operational detail is provided beyond the asserted relationship.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.