sinobi
First seen July 5, 2025Active274 claimed victims
The claims below are reproduced as posted by sinobi on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Sinobi is a private vetted-affiliate RaaS group that emerged in mid-2025, believed to be a rebrand of the Lynx/INC ransomware lineage, claiming 176 victims by end of 2025 through double-extortion attacks primarily against mid-market US organizations via compromised SonicWall VPN credentials.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Lashbrook | October 8, 2025 | ransomware_live | — |
| Tibbetts Lumber | October 8, 2025 | ransomware_live | — |
| Niess Agriculture | October 8, 2025 | ransomware_live | — |
| Industrial Chemicals | October 8, 2025 | ransomware_live | — |
| D. Wilson Construction | October 8, 2025 | ransomware_live | — |
| MTI America | October 8, 2025 | ransomware_live | — |
| Sun Fiber | October 8, 2025 | ransomware_live | — |
| Public Relations Society of America | October 8, 2025 | ransomware_live | — |
| The Catered Affair | October 8, 2025 | ransomware_live | — |
| Law Offices of James Scott Farrin | October 6, 2025 | ransomware_live | — |
| Rogue Valley Door | October 6, 2025 | ransomware_live | — |
| Harmony Brands | October 2, 2025 | ransomware_live | — |
| Integrity Wealth Consulting | October 1, 2025 | ransomware_live | — |
| Lugand Aciers | October 1, 2025 | ransomware_live | — |
| AT Solution | October 1, 2025 | ransomware_live | — |
| Johnson Regional Medical Center | October 1, 2025 | ransomware_live | — |
| Karat by Lollicup | October 1, 2025 | ransomware_live | — |
| Prince William Ice Center | October 1, 2025 | ransomware_live | — |
| Spectrum Painting | October 1, 2025 | ransomware_live | — |
| Naftali Group | September 28, 2025 | ransomware_live | — |
| Immaculate Heart of Mary | September 28, 2025 | ransomware_live | — |
| Friendly Gus | September 19, 2025 | ransomware_live | — |
| United Pharma | September 18, 2025 | ransomware_live | — |
| American Association on Health and Disability | September 13, 2025 | ransomware_live | — |
| Tryon Distributing | September 12, 2025 | ransomware_live | — |
| Dakota Boys and Girls Ranch | September 9, 2025 | ransomware_live | — |
| Melwood | September 8, 2025 | ransomware_live | — |
| Right at Home Care | September 2, 2025 | ransomware_live | — |
| LASER AUTOMOTIVE VALENCIA SL | August 27, 2025 | ransomware_live | — |
| Desert Plastering | August 21, 2025 | ransomware_live | — |
| Judson Center | August 20, 2025 | ransomware_live | — |
| Osland Financial Group | August 19, 2025 | ransomware_live | — |
| Central Jersey Medical Center | August 17, 2025 | ransomware_live | — |
| JB Brown & Sons | August 14, 2025 | ransomware_live | — |
| One Way Solutions | August 13, 2025 | ransomware_live | — |
| J Derenzo | August 13, 2025 | ransomware_live | — |
| Comprehensive Pain Centers | August 13, 2025 | ransomware_live | — |
| Energy Developments | August 9, 2025 | ransomware_live | — |
| Eagan Insurance | August 9, 2025 | ransomware_live | — |
| TRANTRONICS | August 9, 2025 | ransomware_live | — |
| T&D Engineers | August 9, 2025 | ransomware_live | — |
| Stewart Home School | August 9, 2025 | ransomware_live | — |
| Dance Brothers | August 9, 2025 | ransomware_live | — |
| Crane Production Systems | August 9, 2025 | ransomware_live | — |
| Punctual Abstract | August 9, 2025 | ransomware_live | — |
| WaltersMorgan Construction | August 9, 2025 | ransomware_live | — |
| Belleville International | August 9, 2025 | ransomware_live | — |
| White Birch Paper | August 9, 2025 | ransomware_live | — |
| The Green Labs | August 9, 2025 | ransomware_live | — |
| Watsonville Community Hospital | August 9, 2025 | ransomware_live | — |
| Ganther Construction | August 9, 2025 | ransomware_live | — |
| Calsoft Systems | August 7, 2025 | ransomware_live | — |
| Bignault & Carter | August 6, 2025 | ransomware_live | — |
| Pittsburgh Gastroenterology Associates | August 5, 2025 | ransomware_live | — |
| The DM Burr Group | August 4, 2025 | ransomware_live | — |
| Horizon Hydraulics | July 31, 2025 | ransomware_live | — |
| KMDI | July 29, 2025 | ransomware_live | — |
| Mediate Management | July 29, 2025 | ransomware_live | — |
| ECM Consultants | July 27, 2025 | ransomware_live | — |
| Main Electric Supply Co. | July 22, 2025 | ransomware_live | — |
| Mid West Fabricating | July 18, 2025 | ransomware_live | — |
| TELACU College | July 18, 2025 | ransomware_live | — |
| Dyson Corp. | July 15, 2025 | ransomware_live | — |
| Harmony Electronics Corp | July 15, 2025 | ransomware_live | — |
| Advanced Security Systems | July 15, 2025 | ransomware_live | — |
| Norwest Venture Partners | July 10, 2025 | ransomware_live | — |
| Hana Financial | June 26, 2025 | ransomware_live | — |
| Burger & Brown Engineering | June 26, 2025 | ransomware_live | — |
| Built Environment Engineers | June 23, 2025 | ransomware_live | — |
| PK Contracting | June 20, 2025 | ransomware_live | — |
| Hygrade Components | June 15, 2025 | ransomware_live | — |
| Queens Center For Change | June 15, 2025 | ransomware_live | — |
| Dorrell Fabrics | June 15, 2025 | ransomware_live | — |
| Mutual Screw & Supply | March 24, 2025 | ransomware_live | — |
← NewerPage 3 of 3
Claim data from ransomware.live and RansomLook (CC BY 4.0).