Sinobi
Active Since
June 2025
Sinobi began activity in June 2025, and has since maintained a consistent rhythm of attacks against a range of industries and geographies.
It is believed to be linked to the IncRansom and Lynx operations, with their leak sites sharing multiple visual similarities.
