BianLian

BianLian is a name used for two distinct malware contexts: a Go-based ransomware and extortion operation targeting enterprise environments, and an unrelated Android banking malware family. In enterprise intrusions, BianLian emerged as a ransomware actor using custom Go malware including a backdoor and an encryptor. It has been observed gaining initial access through exploitation of ProxyShell vulnerabilities, attacks on SonicWall VPN appliances, and abuse of weak or exposed remote-access credentials. After access, operators rely heavily on living-off-the-land techniques such as RDP, WinRM, WMI, and PowerShell for reconnaissance, lateral movement, persistence, and defense evasion. Reported behaviors include disabling or bypassing security controls, modifying firewall and remote-access settings, deleting backups and shadow copies, exfiltrating data with common administrative tools, and deploying a custom backdoor that can retrieve and execute payloads in memory. BianLian initially operated as a double-extortion ransomware, but by early 2023 it was widely reported to have shifted toward exfiltration-based extortion without file encryption. Victims have included organizations in manufacturing, healthcare, education, information and communications, and other sectors, with activity concentrated in North America, the United Kingdom, and Australia.

Separately, Android/BianLian is a banking trojan family first publicly discussed in 2018 and primarily associated with campaigns targeting Turkish banking and financial applications, later expanding to additional regions and app categories including cryptocurrency services. This Android malware abuses Accessibility Services, hides its icon, dynamically loads secondary components, and communicates with command-and-control infrastructure over HTTP. Its modular capabilities include SMS interception and sending, overlay-based credential theft, USSD execution, device locking, notification suppression, PIN theft or manipulation, screen capture or screencasting, remote app installation, and TeamViewer-assisted remote access. Some variants also implement SOCKS5 or SSH proxy functionality and retrieve updated command-and-control information from remote intermediary services. Because the same name is used for both the enterprise extortion malware and the Android banking trojan, analysts should distinguish them carefully; available reporting has explicitly noted no observed operational connection between the Android banking malware and the BianLian ransomware group.