Is This a Rebrand? New Sinobi Ransomware Group Shows Code Overlap with Lynx

According to eSentire’s Threat Response Unit (TRU), a ransomware attack attributed to an affiliate of the Sinobi Group raises questions that Sinobi may be a rebrand of Lynx, a RaaS operation first observed in 2024.

TRU notes significant code overlaps and other similarities in the ransomware binaries and data leak sites, supporting a medium-confidence view that Lynx likely purchased the INC Ransomware source code from a hacker using the handle “salfetka.” The intrusion used compromised SonicWall SSL VPN credentials tied to an over-privileged Active Directory account, enabling internal network access and direct RDP to a file server.

After gaining access, the attackers created a new local administrator account, moved laterally, and attempted to disable security tools before exfiltrating data with RClone to infrastructure run by Global Connectivity Solutions LLP. The final stage deployed Sinobi ransomware, which encrypts files across local and shared drives and appends the .SINOBI extension, with encryption performed using Curve-25519 Donna + AES-128-CTR and keys generated via CryptGenRandom. Victims receive README.txt ransom notes and a wallpaper change as part of the attack.