Loading threat actor…
BianLian is a financially motivated cybercriminal group active since at least June 2022 that develops ransomware and conducts data-theft extortion. It is assessed as likely based in Russia, with multiple Russia-based affiliates. Also known as the BianLian ransomware group or BianLian gang, it targets organizations across multiple sectors, including healthcare, manufacturing, financial services, government, professional services, telecommunications, and property development. Its victims are concentrated in the United States, with additional targeting in Australia, the United Kingdom, Canada, and other countries. BianLian initially combined file encryption with threats to publish stolen information. Following the release of a free decryptor in January 2023, it shifted primarily toward data-theft extortion and adopted exclusively exfiltration-based extortion around January 2024. It operates a public leak site and pressures victims through threats of financial, legal, operational, and reputational harm. Its coercive practices include threatening telephone calls to employees and printing ransom demands on compromised-network printers. Initial access methods include compromised RDP credentials, credential phishing, and exploitation of exposed applications. A documented intrusion began through a vulnerable TeamCity server, although investigators could not determine which of two candidate vulnerabilities was exploited. BianLian deploys victim-specific Go backdoors and abuses legitimate remote-access and management software for persistence and command and control. It has also deployed an obfuscated PowerShell implementation of its backdoor after security software blocked the Go version. Post-compromise activity includes network and Active Directory discovery, credential dumping, exploitation of CVE-2022-37969 for privilege escalation, creation of privileged accounts, and lateral movement through RDP and PsExec. The group disables security protections, modifies firewall settings, and disguises malicious components as legitimate services. It collects sensitive business and personal information, stages archives, and exfiltrates data using FTP, Rclone, and Mega.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
89 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
7 malware families Mallory has associated with this actor across public reporting.
2 additional families tracked in Mallory.
8 CVEs Mallory has associated with this actor across public reporting. 8 of them are exploited in the wild (not necessarily by this actor).
2 more CVEs tied to this actor tracked in Mallory.
140 indicators attributed to this actor. Values are masked here and available in full in Mallory.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.