bianlian Ransomware
Monitorado desde 14/07/2022
0
vítimas registradas
0
nos últimos 30 dias
0
CVEs
—
Última atividade
BianLian ransomware operations began in late 2021. The group practices multi-pronged extortion, demanding payment for a decryptor, as well as the non-release of stolen data. The ransomware group hosts a public, TOR-based, blog to post victim identities and stolen data. Somewhat unique to BianLian at the time of their launch was their inclusion of an I2P mirror for their blog.
Vulnerabilidades citadas para este grupo
CVEs associadas ao grupo pelo ransomware.live. Fichas ainda não publicadas aparecem sem link.
Nenhuma CVE associada a este grupo nas fontes.
Táticas e técnicas (MITRE ATT&CK)
Execution
T1059 Command and Scripting InterpreterT1204 User Execution Defense Evasion
T1027.002 Software PackingT1036 MasqueradingT1497 Virtualization/Sandbox Evasion Discovery
T1082 System Information DiscoveryT1083 File and Directory DiscoveryT1120 Peripheral Device DiscoveryT1518.001 Security Software Discovery Lateral Movement
T1091 Replication Through Removable Media Impact
T1486 Data Encrypted for Impact Ferramentas observadas
Credential Theft
RDP Recognizer
Discovery Enum
Advanced IP Scanner · Advanced Port Scanner · PingCastle · SharpShares · SoftPerfect NetScan · WKTools
Exfiltration
MEGA · RClone
LOLBAS
PsExec
Offsec
Impacket
RMM-Tools
AmmyyAdmin · AnyDesk · Atera · ScreenConnect · Splashtop · TeamViewer
Vítimas divulgadas em sites de vazamento, segundo o ransomware.live. Não exibimos nomes de vítimas. · Ver no ransomware.live