BianLian

BianLian is a ransomware and data-extortion malware family/operator first observed in attacks in June 2022, with the ransomware itself described as emerging in August 2022. It is associated with a Russia-linked cybercriminal group with multiple Russia-based affiliates and has targeted organizations in the United States and abroad, including multiple U.S. critical infrastructure sectors and Australian organizations. Reported victim sectors include healthcare, manufacturing, media and entertainment, professional services, property development, financial services, and mining/rare earths. Specific incidents referenced include compromises affecting Northern Minerals in Australia, Collins Aerospace, and Alpine Ear, Nose, and Throat.

Technically, BianLian ransomware is a Go-based 64-bit Windows executable. Avast reported that known variants encrypt file data with AES-256-CBC, scanning drives A: through Z: and encrypting files matching 1,013 hardcoded extensions. Known samples use a fixed hardcoded offset within files rather than encrypting from the beginning, append the .bianlian extension to encrypted files, drop a ransom note named "Look at this instruction.txt" in affected folders, and self-delete after execution via "cmd /c del <sample_exe_name>". Avast released a public decryptor for known BianLian variants in January 2023.

Operational reporting indicates BianLian historically conducted double extortion, combining data theft with file encryption, but shifted primarily to exfiltration-only extortion around January 2023 after the decryptor release, and by January 2024 was reported as exclusively using exfiltration-based extortion in some government reporting. Initial access methods directly mentioned include valid RDP credentials, phishing, and exploitation of public-facing applications; the FBI/CISA/ACSC advisory also notes possible use of the ProxyShell exploit chain against Windows and ESXi infrastructure. The group uses a custom victim-specific Go backdoor, remote management/access tools, account creation and password changes, Ngrok and modified Rsocks for proxying/SOCKS5 tunneling, PowerShell and Windows Command Shell to disable defenses, and registry changes to weaken Sophos protections. Reported discovery and credential-access activity includes use of Advanced Port Scanner, SoftPerfect Network Scanner, SharpShares, PingCastle, LSASS credential theft, attempts to access NTDS.dit, and in at least one case an Impacket secretsdump-derived tool. Lateral movement has been observed via PsExec, RDP, SMB, firewall-rule changes to permit RDP, and an artifact linked to possible exploitation of CVE-2020-1472; privilege escalation via CVE-2022-37969 has also been reported. Data exfiltration methods explicitly mentioned include FTP, Rclone, and Mega.

Known indicators and artifacts directly referenced in the content include the .bianlian file extension, the ransom note "Look at this instruction.txt," common executable paths/names such as C:\Windows\TEMP\mativ.exe, C:\Windows\Temp\Areg.exe, C:\Users\%username%\Pictures\windows.exe, and anabolic.exe, and the self-deletion command pattern noted above.