bianlian Ransomware
Tracked since Jul 14, 2022
0
victims recorded
0
in the last 30 days
0
CVEs
—
Last activity
BianLian ransomware operations began in late 2021. The group practices multi-pronged extortion, demanding payment for a decryptor, as well as the non-release of stolen data. The ransomware group hosts a public, TOR-based, blog to post victim identities and stolen data. Somewhat unique to BianLian at the time of their launch was their inclusion of an I2P mirror for their blog.
Vulnerabilities cited for this group
CVEs associated with the group by ransomware.live. Records not yet published here appear without a link.
No CVE associated with this group in the sources.
Tactics and techniques (MITRE ATT&CK)
Execution
T1059 Command and Scripting InterpreterT1204 User Execution Defense Evasion
T1027.002 Software PackingT1036 MasqueradingT1497 Virtualization/Sandbox Evasion Discovery
T1082 System Information DiscoveryT1083 File and Directory DiscoveryT1120 Peripheral Device DiscoveryT1518.001 Security Software Discovery Lateral Movement
T1091 Replication Through Removable Media Impact
T1486 Data Encrypted for Impact Observed tools
Credential Theft
RDP Recognizer
Discovery Enum
Advanced IP Scanner · Advanced Port Scanner · PingCastle · SharpShares · SoftPerfect NetScan · WKTools
Exfiltration
MEGA · RClone
LOLBAS
PsExec
Offsec
Impacket
RMM-Tools
AmmyyAdmin · AnyDesk · Atera · ScreenConnect · Splashtop · TeamViewer
Victims posted on leak sites, according to ransomware.live. Victim names are not displayed. · View on ransomware.live