[SINOBI] – Ransomware Victim: SANHUA INTERNATIONAL
NOTE: No files or stolen information are exfiltrated, downloaded, taken, hosted, seen, reposted, or disclosed by RedPacket Security. Any legal issues relating to the content should be directed at the attackers, not RedPacket Security. This blog is an editorial notice informing that a company has fallen victim to a ransomware attack. RedPacket Security is not affiliated with any ransomware threat actors or groups and will not host infringing content. The information on this page is automated and redacted whilst being scraped directly from the SINOBI Onion Dark Web Tor Blog page.
AI Generated Summary of the Ransomware Leak Page
SANHUA INTERNATIONAL is identified as the victim in a ransomware leak post attributed to the Sinobi group. The company operates in the manufacturing sector and is based in China. The post date is 2025-10-21 18:17:21.678000; since no compromise date is provided, this is treated as the leak post date. The leak page centers on SANHUA INTERNATIONAL’s business profile rather than explicit breach details, highlighting eco-friendly refrigeration and air conditioning components designed to operate with natural refrigerants such as R290, R600a, and R744. It lists components including valves, controllers, transducers, filter driers and micro-channel heat exchangers, and frames these offerings as aligned with U.S. EPA mandates for greener refrigeration solutions, noting a North America introduction at the 2017 AHR Expo in Las Vegas.
Impact and ransom specifics are not explicitly stated in the provided data. The leak page shows no screenshots or downloadable files (images_count and downloads_present are both zero) and provides no stated ransom amount (income_or_ransom is empty). A claim URL is present on the page (defanged in this summary), but the actual address is not included here. There is no direct evidence in the dataset to confirm whether encryption or data exfiltration occurred; the post appears to emphasize SANHUA INTERNATIONAL’s product portfolio rather than detailing a breach, leaving the exact nature of the incident and its impact undetermined based on the information given.
Support Our Work
A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.
If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.
