During October 2008, the RSA Anti-Fraud Command Center discovered that the Sinowal Trojan had compromised and stolen login credentials from approximately 270,000 online bank accounts and 240,000 credit and debit cards since as far back as February 2006. Other information such as e-mail and FTP accounts from numerous websites were also compromised and stolen.

The Sinowal Trojan has been the subject of rumor and speculation in the industry, and little is known about its source. There is generally more known about the sources of other Trojans. RSA's data showed that the Sinowal Trojan had strong ties to the Russian Business Network (RBN) in the past, but more recent research indicates that the current hosting facilities of Sinowal may have changed and are no longer connected to the RBN.