# Sinobi Ransomware: Curve-25519/AES-128-CTR Encryption with Shadow Copy and Backup Destruction (Lynx/INC Rebrand)

> Sinobi is a closed Ransomware-as-a-Service operation first observed in late June 2025 and assessed to be a rebrand of the Lynx ransomware gang (itself derived from the INC codebase). It encrypts files with Curve-25519 key exchange and AES-128-CTR (partial 5/15/25% modes, .SINOBI extension), destroys Volume Shadow Copies via DeviceIoControl IOCTL_VOLSNAP_SET_MAX_DIFF_AREA_SIZE (0x53C028) abuse, empties the Recycle Bin, and terminates backup/database processes to inhibit recovery. An ESentire-documented August 2025 intrusion used compromised SonicWall SSL VPN credentials inherited from an MSP for initial access.

- **Published:** 2026-06-21T00:00:00Z
- **Last reviewed:** 2026-06-21T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0892
- **ID:** TL-2026-0892
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Sinobi
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2024-53704

## Description

Sinobi is a financially motivated, closed/hybrid Ransomware-as-a-Service (RaaS) operation in which a core team manages the malware, infrastructure, and negotiation systems while a small set of trusted affiliates conduct intrusions. The group emerged in late June 2025 (clear-web negotiation site chat.sinobi.us.org was registered 22 June 2025) and grew rapidly from roughly 40 named victims in September 2025 to over 215 by January 2026, placing it among the four most active operators alongside Lynx, Qilin, and Akira at the start of 2026. Technical and infrastructure overlap — significant binary code resemblance, near-identical data-leak-site structure, and shared double-extortion methodology — strongly support the assessment that Sinobi is a rebrand/successor of the Lynx ransomware gang, which in turn inherited code from the earlier INC ransomware family.

The Windows payload encrypts each file with a per-file key: it generates a fresh 32-byte ephemeral Curve-25519 private key via CryptGenRandom, derives a shared secret with the operator public key, hashes it with SHA-512 (first 16 bytes used as the AES-128 key, next 16 bytes as the CTR counter), then discards the victim private key. AES-128 runs in CTR mode and supports partial-encryption modes of 5%, 15%, and 25% to accelerate locking of large files. Encrypted files receive the .SINOBI extension and a footer storing the victim's 32-byte ephemeral public key, a 4-byte encryption mode, and a 4-byte completion status. Encryption runs in parallel threads.

To inhibit recovery, Sinobi deletes Volume Shadow Copies stealthily by calling DeviceIoControl with the IOCTL_VOLSNAP_SET_MAX_DIFF_AREA_SIZE control code (0x53C028) and a zero-size input buffer — forcing Windows to discard all existing shadow copies on a volume while avoiding the noisy 'vssadmin delete shadows' pattern that EDR flags. It empties every recycle bin via the SHEmptyRecycleBinA Shell API. It abuses the Restart Manager to detect and terminate processes holding handles to target files, sparing only Explorer and system-critical processes (ApplicationType != RmExplorer && ApplicationType != RmCritical). When launched with the --kill switch, it terminates processes whose names contain sql, veeam, backup, exchange, java, or notepad. It sets HKCU\Control Panel\Desktop\Wallpaper to display a ransom-note image and drops a README.txt ransom note in each affected directory instructing victims to begin negotiations within 7 days.

In an ESentire-reported intrusion (incident report dated 27 August 2025), affiliates accessed a victim through a SonicWall SSL VPN appliance using over-privileged credentials stolen from a third-party MSP — credentials carrying domain administrator privileges, consistent with abuse of the SonicWall SSLVPN authentication-bypass weakness tracked as CVE-2024-53704. The actor pivoted to a file server over RDP, created a persistence account named 'Assistance' and promoted it to local and domain administrators, disabled the Carbon Black EDR service ('sc config cbdefense start= disabled'), rewrote a service binary path to the ransomware payload (bin.exe), and forced a reboot. Data was exfiltrated with RClone over an SSH configuration using the '--max-age=2y' flag to prioritize recent business-critical files, supporting double extortion. AnyDesk was observed for remote access. Targeting skews to US-based midsize organizations (~$10-50M revenue) across manufacturing, construction, healthcare, finance, and education.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1078 Valid Accounts
- T1199 Trusted Relationship
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1136 Create Account
- T1543 Create or Modify System Process
- T1134 Access Token Manipulation
- T1098 Account Manipulation
- T1078 Valid Accounts
- T1685 Disable or Modify Tools
- T1070 Indicator Removal
- T1112 Modify Registry
- T1082 System Information Discovery
- T1057 Process Discovery
- T1083 File and Directory Discovery
- T1120 Peripheral Device Discovery
- T1049 System Network Connections Discovery
- T1087 Account Discovery
- T1018 Remote System Discovery
- T1021 Remote Services
- T1105 Ingress Tool Transfer
- T1219 Remote Access Tools
- T1567 Exfiltration Over Web Service
- T1048 Exfiltration Over Alternative Protocol
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1489 Service Stop

## Sources

- [How Sinobi Ransomware Encrypts Files and Destroys Backups](https://www.picussecurity.com/resource/blog/how-sinobi-ransomware-encrypts-files-and-destroys-backups)
- [Emulating the Concealed Sinobi Ransomware - AttackIQ](https://www.attackiq.com/2026/04/02/sinobi-ransomware/)
- [Sinobi Ransomware Explained: Intrusion Methods, Encryption, and Incident Response - Proven Data](https://www.provendata.com/blog/sinobi-ransomware)
- [Sinobi ransomware: successor to Lynx and INC](https://sosransomware.com/en/ransomware-groups/sinobi-ransomware-successor-to-lynx-and-inc/)
- [Daily-Hunt: Sinobi Ransomware IOCs](https://github.com/TheRavenFile/Daily-Hunt/blob/main/Sinobi%20Ransomware)
- [Threat Actor Profile: Sinobi - Surefire Cyber](https://www.surefirecyber.com/threat-actor-profile-sinobi/)
- [Sinobi: Rebrand of the Lynx Ransomware Gang](https://www.hendryadrian.com/sinobi-rebrand-of-the-lynx-ransomware-gang/)
- [CYFIRMA Weekly Intelligence Report - 11 July 2025](https://www.cyfirma.com/news/weekly-intelligence-report-11-july-2025/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0892