BianLian

BianLian is described by the FBI, CISA and the Australian Cyber Security Centre (ACSC) as a ransomware developer, deployer and data extortion group. They say it is likely based in Russia and works with Russia-based affiliates. The FBI has seen it affect US critical infrastructure organizations since June 2022. The ACSC reports that it has targeted Australian critical infrastructure, plus professional services and property development firms.

A foreign-sounding name

The agencies add a warning on attribution. Several ransomware groups, BianLian among them, pick foreign-language names to hide their real location and nationality, almost certainly to make attribution harder. That is why this page uses only the agencies’ wording on where the group is based.

From encryption to pure data theft

BianLian first used double extortion: it stole files and also encrypted the victim’s systems. According to the advisory, around January 2023 the FBI saw it move mainly to stealing data and leaving systems intact. The ACSC saw it move to data theft only, and the advisory dates that shift to around January 2024. Before then the encryptor added a .bianlian extension to files. Newer ransom notes simply say that data was taken and will be leaked unless the ransom is paid. This matters for planning: backups alone do not answer a threat to publish stolen data.

How the group gets in and moves

The main route is valid Remote Desktop Protocol (RDP) credentials, likely bought from initial access brokers, or phishing. The update adds public-facing applications on Windows and ESXi, possibly through the ProxyShell chain of flaws. Inside the network the actors use a custom backdoor written in Go for each victim, plus remote access software. They disable antivirus, create administrator accounts, and use PsExec and RDP to move. In one case they installed webshells on an Exchange server, and in another they created domain admin and Azure AD accounts to keep access.

They use open source and built-in tools to look around and to take passwords, including memory dumps of LSASS and, in one case, an Impacket tool to harvest credential hashes from a domain controller. Data leaves the network by FTP, Rclone or, in an ACSC case, the Mega file-sharing service.

Tools and stealth

To map a victim, the actors download scanners and Active Directory tools such as SharpShares and PingCastle, then use built-in Windows commands to list users, groups, domain controllers and trusts. To stay hidden they rename programs and scheduled tasks after real Windows services or security products, and they may route traffic through tunnelling tools such as Ngrok or a modified Rsocks. Rclone and other files are placed in folders that rarely get checked, for example a VMware program data folder or a music folder.

The ransom note

Older notes told victims their files were encrypted and gave 10 days before the stolen data would be posted on the group’s site and sent to clients, partners, competitors and news agencies. Newer notes skip the encryption claim and state only that data was taken. In both, the pressure comes from the threat of financial, business and legal harm if payment is not made.

Who should care

CISA’s guide notes that some actors steal data and threaten to release it as their only form of extortion, with no ransomware at all, which is the path BianLian now follows. NIST lists CVE-2022-37969 as a Windows logging driver privilege flaw and CVE-2021-34473 as an Exchange remote code execution flaw.

The agencies urge both critical infrastructure and small and medium organizations to apply the advisory’s mitigations. The advisory names no law enforcement takedown of the group, and none is claimed here.

Steals data, then threatens to publish it unless paid. It used to encrypt files too, but the agencies say it moved to data theft only around January 2024. Contact is through a Tox chat.