Skip to main content
Darkfield

Operator dossier

sinobi is a ransomware operator currently active on public leak sites. Darkfield has indexed 274 public victims claimed by this operator between July 5, 2025 and May 8, 2026. Based on the limited publicly available information, Sinobi appears to be a recently emerged ransomware operation first observed in July 2025, with financial motivations evidenced by their targeting of 268 victims across multiple sectors. The group's origin and specific affiliations remain undocumented in public threat intelligence reporting, and there is no confirmed information regarding whether they operate as a Ransomware-as-a-Service model or as an independent entity. Their attack methodology and technical capabilities have not been extensively documented by major security research organizations, though their targeting patterns suggest a broad opportunistic approach rather than highly selective operations. The group demonstrates a preference for targeting organizations in the United States, India, United Kingdom, Canada, and Italy, with a focus on manufacturing, healthcare, construction, and technology sectors, suggesting they may exploit common vulnerabilities across these industries rather than deploying sophisticated, sector-specific attack vectors. No major high-profile campaigns or significant law enforcement actions against Sinobi have been publicly reported by CISA, FBI, or established threat intelligence firms. Given the recent emergence timeline and lack of extensive public documentation, the group's current operational status and long-term trajectory remain unclear, though the substantial victim count suggests continued activity as of the last available reporting period.

Most-targeted sectors

Most-affected countries

Recent disclosures by sinobi

Most recent 150 of 274 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for sinobi →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Active ransomware operator

← All groups

sinobi

274 victims indexed · first seen 1 year ago · last activity 2 months ago

274
Victims indexed
#34 of 364 tracked operators
10m
Active period
Jul 2025 → May 2026
10
Countries hit
top US · 160

At a glance

Status
active
First seen
1 year ago
Last activity
2 months ago
Onion sites
7 known endpoints
Primary sector
Not Found · 83 hits

About

Based on the limited publicly available information, Sinobi appears to be a recently emerged ransomware operation first observed in July 2025, with financial motivations evidenced by their targeting of 268 victims across multiple sectors. The group's origin and specific affiliations remain undocumented in public threat intelligence reporting, and there is no confirmed information regarding whether they operate as a Ransomware-as-a-Service model or as an independent entity. Their attack methodology and technical capabilities have not been extensively documented by major security research organizations, though their targeting patterns suggest a broad opportunistic approach rather than highly selective operations. The group demonstrates a preference for targeting organizations in the United States, India, United Kingdom, Canada, and Italy, with a focus on manufacturing, healthcare, construction, and technology sectors, suggesting they may exploit common vulnerabilities across these industries rather than deploying sophisticated, sector-specific attack vectors. No major high-profile campaigns or significant law enforcement actions against Sinobi have been publicly reported by CISA, FBI, or established threat intelligence firms. Given the recent emergence timeline and lack of extensive public documentation, the group's current operational status and long-term trajectory remain unclear, though the substantial victim count suggests continued activity as of the last available reporting period.

References

1 link

External sources curated by the MISP threat-intel community.

Timeline

9 months
2025-07-01T00:00:00+00:00 · 42025-08-01T00:00:00+00:00 · 222025-09-01T00:00:00+00:00 · 122025-10-01T00:00:00+00:00 · 722025-11-01T00:00:00+00:00 · 232025-12-01T00:00:00+00:00 · 542026-01-01T00:00:00+00:00 · 562026-02-01T00:00:00+00:00 · 182026-03-01T00:00:00+00:00 · 7
2025-07-01T00:00:00+00:002026-03-01T00:00:00+00:00

Top countries

🇺🇸 United States
160
🇮🇳 India
10
🇬🇧 United Kingdom
7
🇨🇦 Canada
6
🇮🇹 Italy
5
🇪🇸 Spain
3
🇨🇳 China
2
🇫🇷 France
2
United States dossier →India dossier →United Kingdom dossier →Canada dossier →

Top sectors

Manufacturing
38
Healthcare
34
Construction
24
Technology
23
Business Services
12
Financial Services
11
Consumer Services
10
Hospitality and Tourism
9
Manufacturing dossier →Healthcare dossier →Construction dossier →Technology dossier →

MITRE ATT&CK

4 techniques · 4 tactics

Tactics

Initial AccessExecutionDefense EvasionImpact

Techniques

  • T1566Phishing
  • T1059Command and Scripting Interpreter
  • T1027Obfuscated Files or Information
  • T1486Data Encrypted for Impact

Recent victims

Loading…

Onion infrastructure

7 known
  • http://sinobi23i75c3znmqqxxyuzqvhxnjsar7actgvc4nqeuhgcn5yvz3zqd.onion/leaks
  • http://sinobi6ftrg27d6g4sjdt65malds6cfptlnjyw52rskakqjda6uvb7yd.onion/leaks
  • http://sinobi6rlec6f2bgn6rd72xo7hvds4a5ajiu2if4oub2sut7fg3gomqd.onion/leaks
  • http://sinobi6ywgmmvg2gj2yygkb2hxbimaxpqkyk27wti5zjwhfcldhackid.onion/leaks
  • http://sinobi7l3wet3uqn4cagjiessuomv75aw3bvgah4jpj43od7xndb7kad.onion/leaks
  • http://sinobi7sukclb3ygtorysbtrodgdbnrmgbhov45rwzipubbzhiu5jvqd.onion/leaks
  • http://sinobia6mw6ht2wcdjphessyzpy7ph2y4dyqbd74bgobgju4ybytmkqd.onion/leaks

Source

Updated 2 months ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time sinobi posts a victim.

Add sinobi to your watchlist — Pro pings you within 5 minutes of any new sinobi leak-site post, Telegram callout, or affiliate-rebrand inference.