AttackIQ Releases Sinobi Ransomware Emulation for Security Control Validation
Summary
AttackIQ released an Adversarial Exposure Validation attack graph emulating Sinobi ransomware behaviors, including discovery, privilege escalation and AES-128/Curve25519 file encryption, to test security controls and response workflows.
Key points
- AttackIQ says the attack graph reproduces Sinobi-associated behaviors to help organizations test detection, prevention and incident-response controls.
- The emulation covers system, environment and process discovery, local account creation, administrator-group changes and privilege manipulation.
- It also models network-resource, printer, volume, drive and file enumeration before in-place file encryption using AES-128 in CTR mode and Curve25519 for key protection.
- Download-and-save scenarios use a Sinobi sample to test network and endpoint controls against delivery of a known malicious sample.
- The emulation is based on behaviors reported by eSentire on August 27, 2025, and AttackIQ’s internal analysis.
- The article says Sinobi emerged in late June 2025 as a financially motivated, closed hybrid RaaS operation; technical and infrastructure overlaps suggest it may be a rebrand or successor to Lynx, which inherited code from INC.
Article Details
- Event Type
- AttackIQ released an emulation of Sinobi ransomware behaviors for its Adversarial Exposure Validation platform.
- Impact
- The emulation is intended to help organizations test detection, prevention, and response controls against reported Sinobi behaviors, including discovery, privilege escalation, network and file enumeration, and file encryption. The article does not report a specific victim or a new ransomware incident.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 1b2a1e41a7f65b8d9008aa631f113cef36577e912c13f223ba8834bbefa4bd14 | SHA-256 hash of the Sinobi ransomware sample used in the emulation and testing scenarios. |
MITRE ATT&CK
T1049 · System Network Connections DiscoveryThe emulation enumerates network resources using WNetOpenEnumW and WNetEnumResourceW.T1057 · Process DiscoveryThe emulation enumerates running processes using Windows process snapshot APIs.T1082 · System Information DiscoveryThe emulation retrieves system information and environment variables, and enumerates system volumes.T1083 · File and Directory DiscoveryThe emulation traverses the file system to identify files.T1098 · Account ManipulationThe emulation adds a local user to the local Administrators group.T1105 · Ingress Tool TransferThe emulation downloads and saves a Sinobi sample to test controls against file delivery.T1120 · Peripheral Device DiscoveryThe emulation enumerates available printers and retrieves drive type information.T1134 · Access Token ManipulationThe emulation enables SeTakeOwnershipPrivilege for the process using the AdjustTokenPrivilege Windows API.T1136.001 · Local AccountThe emulation attempts to create a local user account.T1486 · Data Encrypted for ImpactThe emulation reproduces in-place file encryption using AES-128 in CTR mode, with Curve25519 for key protection.
Threat Actors
LynxDescribed as a ransomware group and the likely predecessor or former identity of Sinobi, according to the article's assessment.sinobiDescribed as a financially motivated ransomware group operating a closed, hybrid RaaS model. The article says technical and infrastructure overlaps suggest it is likely a rebrand or direct successor of Lynx.
Malware
INC ransomwareSinobi is a financially motivated ransomware group that emerged in June 2025 operating a closed, hybrid Ransomware-as-a-Service model and likely represents a rebrand or direct successor to the Lynx and INC families.LynxSinobi is a financially motivated ransomware group that emerged in June 2025 operating a closed, hybrid Ransomware-as-a-Service model and likely represents a rebrand or direct successor to the Lynx and INC families.SinobiSinobi is a financially motivated ransomware group that emerged in June 2025 operating a closed, hybrid Ransomware-as-a-Service model and likely represents a rebrand or direct successor to the Lynx and INC families.