Threat reportRansomwareTL-2026-0892
Sinobi Ransomware: Curve-25519/AES-128-CTR Encryption with Shadow Copy and Backup Destruction (Lynx/INC Rebrand)
Sinobi Ransomware (TL-2026-0892), also tracked as Sinobi Ransomware, is a high-severity ransomware operation, first published 2026-06-21. It is attributed to Sinobi with medium confidence, affects Microsoft Windows, references 1 CVE (CVE-2024-53704), maps to 28 MITRE ATT&CK techniques (T1018, T1021, T1048), and is covered by 9 detection rules and 26 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 28MITRE ATT&CK
- Actors
- 1Sinobi
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 26Indicators of compromise
Key facts for TL-2026-0892
- Threat ID
- TL-2026-0892
- Also known as
- Sinobi Ransomware, Sinobi RaaS
- Severity
- HIGH
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution
- Sinobi
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- manufacturing, construction, healthcare, financial, education
- Target regions
- North America, United States
- Detection rules
- 9
- Indicators of compromise
- 26
Malware and tooling in Sinobi Ransomware
Malware and tooling: sinobi, AnyDesk, rclone.exe
How Sinobi Ransomware works
Sinobi is a closed Ransomware-as-a-Service operation first observed in late June 2025 and assessed to be a rebrand of the Lynx ransomware gang (itself derived from the INC codebase). It encrypts files with Curve-25519 key exchange and AES-128-CTR (partial 5/15/25% modes, .SINOBI extension), destroys Volume Shadow Copies via DeviceIoControl IOCTL_VOLSNAP_SET_MAX_DIFF_AREA_SIZE (0x53C028) abuse, empties the Recycle Bin, and terminates backup/database processes to inhibit recovery. An ESentire-documented August 2025 intrusion used compromised SonicWall SSL VPN credentials inherited from an MSP for initial access.
Sinobi is a financially motivated, closed/hybrid Ransomware-as-a-Service (RaaS) operation in which a core team manages the malware, infrastructure, and negotiation systems while a small set of trusted affiliates conduct intrusions. The group emerged in late June 2025 (clear-web negotiation site chat.sinobi.us.org was registered 22 June 2025) and grew rapidly from roughly 40 named victims in September 2025 to over 215 by January 2026, placing it among the four most active operators alongside Lynx, Qilin, and Akira at the start of 2026. Technical and infrastructure overlap — significant binary code resemblance, near-identical data-leak-site structure, and shared double-extortion methodology — strongly support the assessment that Sinobi is a rebrand/successor of the Lynx ransomware gang, which in turn inherited code from the earlier INC ransomware family.
The Windows payload encrypts each file with a per-file key: it generates a fresh 32-byte ephemeral Curve-25519 private key via CryptGenRandom, derives a shared secret with the operator public key, hashes it with SHA-512 (first 16 bytes used as the AES-128 key, next 16 bytes as the CTR counter), then discards the victim private key. AES-128 runs in CTR mode and supports partial-encryption modes of 5%, 15%, and 25% to accelerate locking of large files. Encrypted files receive the .SINOBI extension and a footer storing the victim's 32-byte ephemeral public key, a 4-byte encryption mode, and a 4-byte completion status. Encryption runs in parallel threads.
To inhibit recovery, Sinobi deletes Volume Shadow Copies stealthily by calling DeviceIoControl with the IOCTL_VOLSNAP_SET_MAX_DIFF_AREA_SIZE control code (0x53C028) and a zero-size input buffer — forcing Windows to discard all existing shadow copies on a volume while avoiding the noisy 'vssadmin delete shadows' pattern that EDR flags. It empties every recycle bin via the SHEmptyRecycleBinA Shell API. It abuses the Restart Manager to detect and terminate processes holding handles to target files, sparing only Explorer and system-critical processes (ApplicationType != RmExplorer && ApplicationType != RmCritical). When launched with the --kill switch, it terminates processes whose names contain sql, veeam, backup, exchange, java, or notepad. It sets HKCU\Control Panel\Desktop\Wallpaper to display a ransom-note image and drops a README.txt ransom note in each affected directory instructing victims to begin negotiations within 7 days.
In an ESentire-reported intrusion (incident report dated 27 August 2025), affiliates accessed a victim through a SonicWall SSL VPN appliance using over-privileged credentials stolen from a third-party MSP — credentials carrying domain administrator privileges, consistent with abuse of the SonicWall SSLVPN authentication-bypass weakness tracked as CVE-2024-53704. The actor pivoted to a file server over RDP, created a persistence account named 'Assistance' and promoted it to local and domain administrators, disabled the Carbon Black EDR service ('sc config cbdefense start= disabled'), rewrote a service binary path to the ransomware payload (bin.exe), and forced a reboot. Data was exfiltrated with RClone over an SSH configuration using the '--max-age=2y' flag to prioritize recent business-critical files, supporting double extortion. AnyDesk was observed for remote access. Targeting skews to US-based midsize organizations (~$10-50M revenue) across manufacturing, construction, healthcare, finance, and education.
MITRE ATT&CK techniques used in TL-2026-0892
Discovery
T1018 Remote System Discovery; T1049 System Network Connections Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1087 Account Discovery; T1120 Peripheral Device Discovery
Lateral Movement
Exfiltration
T1048 Exfiltration Over Alternative Protocol; T1567 Exfiltration Over Web Service
Execution
T1059 Command and Scripting Interpreter; T1106 Native API
Defense Evasion
Initial Access
T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1199 Trusted Relationship
Privilege Escalation
T1078 Valid Accounts; T1098 Account Manipulation; T1134 Access Token Manipulation
Command and Control
T1105 Ingress Tool Transfer; T1219 Remote Access Tools
defense-impairment
T1112 Modify Registry; T1685 Disable or Modify Tools
Persistence
T1136 Create Account; T1543 Create or Modify System Process
Impact
T1486 Data Encrypted for Impact; T1489 Service Stop; T1490 Inhibit System Recovery
Affected products and versions in Sinobi Ransomware
Remediation for Sinobi Ransomware
Patches
- Apply SonicWall fixed firmware for CVE-2024-53704 (SSLVPN authentication bypass)
Immediate actions
- Block known Sinobi C2 and negotiation infrastructure (chat.sinobi.us.org, 194.87.145.118, 40.69.42.241, 20.109.210.53, 52.185.211.133) at the perimeter
- Force-reset all credentials associated with MSP/third-party access and SonicWall SSL VPN accounts; revoke over-privileged accounts
- Hunt for the rogue 'Assistance' account and any unexpected local/domain administrators
- Audit and re-enable any disabled EDR services (e.g. Carbon Black 'cbdefense'); alert on 'sc config ... start= disabled'
Workarounds
- Disable SSL VPN where not required or restrict to known source IPs
- Block unauthorized remote-access software (AnyDesk) and outbound SSH/cloud-sync from servers
Longer-term hardening
- Patch SonicWall SSLVPN against CVE-2024-53704 and enforce MFA on all VPN and remote-access accounts
- Deploy EDR with tamper protection and behavioral detection for DeviceIoControl shadow-copy abuse and Restart Manager process termination
- Implement immutable/offline backups isolated from production credentials and monitor for RClone/SSH bulk exfiltration
- Enforce least privilege for MSP and service accounts; segment file servers and restrict RDP via jump hosts
CVEs associated with Sinobi Ransomware
Weaknesses (CWE) in Sinobi Ransomware
Timeline of Sinobi Ransomware
- Lynx ransomware (Sinobi's assessed predecessor, derived from the INC codebase) active beginning 2024.
- Sinobi clear-web negotiation site chat.sinobi.us.org registered (IP 194.87.145.118, Russia, ASN AS48347).
- Sinobi RaaS group first observed / emerged in late June 2025; assessed rebrand of the Lynx gang.
- CYFIRMA Weekly Intelligence Report documents Sinobi activity.
- ESentire incident report: Sinobi deployed via compromised SonicWall SSL VPN credentials stolen from an MSP; rogue 'Assistance' admin account created, Carbon Black EDR disabled, RClone exfiltration.
- Approximately 40 named victims listed on Sinobi leak site by September 2025.
- Victim count exceeds 215 by January 2026; ranked among the four most active operators alongside Lynx, Qilin, and Akira.
- AttackIQ publishes adversary emulation and full MITRE ATT&CK mapping of Sinobi ransomware.
- Picus Security publishes technical analysis of Sinobi encryption and backup-destruction mechanics.
Sources cited for Sinobi Ransomware
- How Sinobi Ransomware Encrypts Files and Destroys Backups
- Emulating the Concealed Sinobi Ransomware - AttackIQ
- Sinobi Ransomware Explained: Intrusion Methods, Encryption, and Incident Response - Proven Data
- Sinobi ransomware: successor to Lynx and INC
- Daily-Hunt: Sinobi Ransomware IOCs
- Threat Actor Profile: Sinobi - Surefire Cyber
- Sinobi: Rebrand of the Lynx Ransomware Gang
- CYFIRMA Weekly Intelligence Report - 11 July 2025
Detection coverage for TL-2026-0892
As of 2026-06-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0892 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.