Sinobi
No sourced public emblem in this profile.
reference profile · reported nexus: Unknown (not nationality)
Sinobi is a financially motivated ransomware group that employs data theft and extortion as primary tactics, operating a public-facing leak portal to pressure victims during ransom negotiations. The group utilizes techniques such as phishing, credential compromise, and exploitation of unpatched vulnerabilities for initial access, followed by data exfiltration using tools like RClone. Sinobi ransomware employs Curve-25519 and AES-128-CTR for file encryption, making recovery impossible without the attacker's private key. The group has been linked to significant breaches across various sectors, including automotive, legal, and nonprofit organizations.
Source-reported aliases: . Associations do not prove equivalence.
Target geography
Catalog-listed countries (associations, not attack counts): No country-level metadata
63 observed public claim posts in the collection window 2025-11-21 through 2026-10-25. Accumulated bounded samples: newest 1,000 records from each of the current and previous source years, refreshed every six hours. Historical gaps are not filled. These are not confirmed attacks or unique victims. Dates are provider record dates; countries are provider classifications; unknown is retained. Source: Ransomfeed — Dario Fadda · CC BY 4.0. Adapted into anonymous counts by Kinwilder; no endorsement implied.
United States of America: 52 posts
United Kingdom: 2 posts
India: 2 posts
Canada: 2 posts
Italy: 2 posts
Denmark: 1 posts
Germany: 1 posts
Australia: 1 posts
Historical casebook
No dated record curated yet; absence does not establish inactivity.
Planned Kinwilder coverage
Tentative editorial review windows, contingent on evidence and review; not promised publication dates or predictions of attacks.
No assigned review window.