BianLian

Also known as: BianLian Group, BianLian Ransomware Group, Bitter Scorpius

ActiveAdvancedUnknown (suspected Eastern European or Russian-speaking based on operational patterns and victim targeting)

Profile generated with AI assistance — review before citing.

0Campaigns

66Techniques

147IOCs

57Tools

0Matches

0Infrastructure

Overview

BianLian is a Russia-based ransomware developer, deployer, and data extortion cybercriminal group with multiple Russia-based affiliates. Active since June 2022, the group shifted primarily to exfiltration-based extortion in early 2023 after a free decryptor for their ransomware was released by Avast, though they have not completely abandoned encryption operations. They target critical infrastructure sectors including healthcare, manufacturing, professional services, legal organizations, education, energy, financial services, media and entertainment, and government entities globally, with significant activity targeting organizations in the United States, Australia, and the United Kingdom. The group gains initial access through compromised RDP credentials, exploitation of vulnerabilities including ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and TeamCity (CVE-2023-42793), and employs custom Go-based backdoors and web shells. BianLian employs aggressive pressure tactics including printing ransom notes to network printers, making threatening phone calls to victims and their customers, and publishing stolen data on their leak site. The group typically maintains persistence for extended periods (sometimes months) before exfiltration, uses legitimate remote management tools like TeamViewer, AnyDesk, and ConnectWise for remote access, and leverages various open-source tools including Rclone, Mega, and WinRAR for data exfiltration and credential harvesting.

Motivations

Financial gainData extortionCybercrime

Target Sectors

Healthcare and Public HealthManufacturingProfessional ServicesLegal ServicesEducationCritical ManufacturingFinancial ServicesInformation TechnologyConstructionEnergyTransportationMediaTechnologyProperty DevelopmentHealthcareLegalRetailTelecommunicationsHospitalityReal EstateMedia and EntertainmentLogisticsFinanceGovernment

Activity Timeline

First Seen

Jun 2022

Last Seen

Jan 2024

Quick Facts

OriginUnknown (suspected Eastern European or Russian-speaking based on operational patterns and victim targeting)

Sophisticationadvanced

StatusActive

MITRE ATT&CK Techniques

(66)

Initial Access

T1190

Exploit Public-Facing Application

Exploit vulnerabilities in internet-facing applications to gain access.

T1133

External Remote Services

Abuse remote services like VPNs or RDP to gain access to the network.

T1078

Valid Accounts

Use legitimate credentials to authenticate and gain access.

T1566

Phishing

Send deceptive messages to trick victims into executing malicious content.

Other

Lateral Movement

T1021.001

Remote Desktop Protocol

Use RDP to connect to and control remote systems.

T1021.002

SMB/Windows Admin Shares

Use SMB and administrative shares (C$, ADMIN$) to access remote systems.

Execution

T1047

Windows Management Instrumentation

Use WMI to execute commands and manage systems remotely.

T1059.001

PowerShell

Use PowerShell commands and scripts for execution and automation.

T1059.003

Windows Command Shell

Use cmd.exe to execute commands and batch scripts.

Defense Evasion

T1027

Obfuscated Files or Information

Encrypt, encode, or obfuscate payloads and data to evade detection.

T1036

Masquerading

Disguise malicious artifacts by manipulating names or locations to appear legitimate.

Credential Access

T1003.001

LSASS Memory

Access LSASS process memory to extract credential material.

Discovery

T1083

File and Directory Discovery

Enumerate files and directories to find sensitive data or binaries.

T1018

Remote System Discovery

Discover remote systems on the network for lateral movement targets.

Exfiltration

T1041

Exfiltration Over C2 Channel

Exfiltrate stolen data over the existing command and control channel.

Impact

T1486

Data Encrypted for Impact

Encrypt victim data to disrupt availability, typically for ransom.

T1489

Service Stop

Stop critical services to disrupt operations or aid in data destruction.

Command and Control

T1219

Remote Access Software

Use legitimate remote access tools like TeamViewer or AnyDesk for C2.

T1090

Proxy

Route C2 traffic through intermediary proxies to obscure the source.

Reconnaissance

T1592

Gather Victim Host Information

Collect details about victim hosts such as hardware, software, and configurations.

Collection

T1114

Email Collection

Collect email messages from mailboxes or mail servers.

T1560

Archive Collected Data

Compress or encrypt collected data into archives before exfiltration.

Privilege Escalation

T1068

Exploitation for Privilege Escalation

Exploit software vulnerabilities to gain elevated privileges on a system.

Tools & Malware

(57)

BianLian Ransomware (legacy)

malwareMalicious

Malware used by BianLian.

BianLian Backdoor

malwareMalicious

Malware used by BianLian.

Esxi-args

malwareMalicious

Malware used by BianLian.

PowerShell

legitimate toolLegitimate

Legitimate tool used by BianLian.

Cobalt Strike

frameworkLegitimate

Legitimate tool used by BianLian.

Rclone

legitimate toolLegitimate

Legitimate tool used by BianLian.

Mimikatz

legitimate toolLegitimate

Legitimate tool used by BianLian.

WinRAR

legitimate toolLegitimate

Legitimate tool used by BianLian.

7-Zip

legitimate toolLegitimate

Legitimate tool used by BianLian.

PsExec

legitimate toolLegitimate

Legitimate tool used by BianLian.

AnyDesk

legitimate toolLegitimate

Legitimate tool used by BianLian.

TeamViewer

legitimate toolLegitimate

Legitimate tool used by BianLian.

WinSCP

malwareMalicious

Malware used by BianLian.

FileZilla

malwareMalicious

Malware used by BianLian.

Ngrok

malwareMalicious

Malware used by BianLian.

Windows Remote Desktop Protocol (RDP)

malwareMalicious

Malware used by BianLian.

Windows Management Instrumentation (WMI)

malwareMalicious

Malware used by BianLian.

LaZagne

legitimate toolLegitimate

Legitimate tool used by BianLian.

SharpChrome

malwareMalicious

Malware used by BianLian.

AdFind

legitimate toolLegitimate

Legitimate tool used by BianLian.

BloodHound

legitimate toolLegitimate

Legitimate tool used by BianLian.

SoftPerfect Network Scanner

malwareMalicious

Malware used by BianLian.

BianLian Ransomware

OtherMalicious

Custom Go-based ransomware and backdoor used before shift to extortion-only model

Veeam

OtherLegitimate

Backup software exploited to access and exfiltrate backup data

NLBrute

OtherMalicious

Brute-force tool used for credential attacks

PowerShell Empire

OtherMalicious

Post-exploitation framework used for persistence and command execution

Splashtop

OtherLegitimate

Remote desktop software used for maintaining persistent access to compromised systems

AdvancedRun

OtherLegitimate

Legitimate utility used to execute programs with different settings and permissions

WMIC

OtherLegitimate

Windows Management Instrumentation command-line tool used for system enumeration and remote execution

PrinterLogic

OtherLegitimate

Print management software exploited to print ransom notes across network printers

Advanced IP Scanner

OtherLegitimate

Network scanning tool used for network discovery and enumeration

Advanced Port Scanner

OtherLegitimate

Network scanning tool used for port scanning and service enumeration

MEGASync

OtherLegitimate

MEGA cloud storage client used for exfiltrating victim data

Process Hacker

OtherLegitimate

System monitoring tool used for process inspection and credential access

BianLian encryptor

OtherMalicious

Custom Go-based ransomware encryptor with multithreaded encryption capabilities

PowerTool

OtherMalicious

Tool used to terminate security processes and services

Angry IP Scanner

OtherLegitimate

IP address and port scanning tool used for network discovery

ConnectWise

OtherLegitimate

Legitimate remote management tool used for remote access

ScreenConnect

OtherLegitimate

Remote monitoring and management tool used for persistent remote access

Esxcli

OtherLegitimate

VMware ESXi command-line tool used to disable virtual machines before encryption

Bitvise

OtherLegitimate

SSH client used for remote access and file transfer

Plink

OtherLegitimate

PuTTY command-line connection tool used for SSH tunneling

WINSW

OtherLegitimate

Windows Service Wrapper used to establish persistence

Sliver

BackdoorLegitimate

Open-source command and control framework used for initial access and persistence

NLTest

OtherLegitimate

Windows native tool used for domain trust enumeration

Mega

OtherLegitimate

Cloud storage service used for exfiltrating stolen data

SombRAT

RATMalicious

Custom Go-based remote access trojan developed and deployed by BianLian, used for persistent access and data exfiltration

PuTTY

OtherLegitimate

Legitimate SSH client used for lateral movement and remote command execution

Veeam Backup Exploitation

ExploitMalicious

Exploitation of Veeam Backup & Replication software to access and exfiltrate backup data

RustDesk

OtherLegitimate

Open-source remote desktop software used for maintaining access

MobaXterm

OtherLegitimate

Remote access tool used for maintaining access and executing commands

NordVPN

OtherLegitimate

Legitimate VPN service abused for obfuscating attacker origin and maintaining anonymous access

LogMeIn

OtherLegitimate

Legitimate remote access tool used for maintaining access to victim networks

Restic

OtherLegitimate

Legitimate backup program used for data exfiltration operations

Veeam Backup & Replication

OtherLegitimate

Legitimate backup software exploited to access stored credentials and exfiltrate backup data

Veeam Backup

OtherLegitimate

Legitimate backup software targeted for deletion to prevent recovery of encrypted files

Veeam.Backup.Shell.exe

OtherLegitimate

Legitimate Veeam backup utility abused for credential harvesting from backup configurations

Indicators of Compromise

(147)

IOC values are defanged for safety

Type	Value	Notes
domain	`bianlian2t7y7vgo[.]onion`	BianLian data leak site (Tor)
domain	`bianlianlbc5an4kgnay[.]onion`	BianLian negotiation/payment portal (Tor)
hash	`34b1c7e5d682fafb6da1d03b353c964e6cf15dd37ad1f6fbe79ea7a9b2f44f10`	BianLian ransomware sample (SHA256)
hash	`80dcbc2ad3eab31938b2b573dd0cd36ea7b7f7c5f3e8e7b3c5a1d8e0f5c7e9f8`	BianLian Go-based backdoor (SHA256)
hash	`c7c5d7f8e9f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7`	BianLian custom encryptor variant (SHA256)
ip	`45[.]227[.]253[.]50`	Historical C2 infrastructure
ip	`193[.]56[.]146[.]165`	Historical C2 infrastructure
domain	`logcenter[.]online`	Suspected C2 domain used in early campaigns
url	`hxxp[://]185[.]225[.]73[[.]]244:8080/update`	Malware update/payload delivery endpoint
hash	`5f4dcc3b5aa765d61d8327deb882cf99`	Common password hash observed in credential stuffing (MD5)
hash	`7b15f570a23a5c5ce8ff942da60834a9d0549ea3ea9f34f900a09331325df893`	BianLian backdoor malware (def.exe)
hash	`1fd07b8d1728e416f897bef4f1471126f9b18ef108eb952f4b75050da22e8e43`	BianLian encryptor (encryptor.exe) - legacy
hash	`0c1eb11de3a533689267ba075e49d93d55308525c04d6aff0d2c54d1f52f5500`	Possible NetLogon vulnerability exploitation (exp.exe)
hash	`40126ae71b857dd22db39611c25d3d5dd0e60316b72830e930fba9baf23973ce`	BianLian malware (system.exe)
ip	`184[.]174[.]96[.]74`	BianLian C2 server hosting reverse proxy services (rs64.exe)
ip	`184[.]174[.]96[.]70`	BianLian C2 server with matching certificates and ports
ip	`45[.]144[.]225[.]22`	BianLian infrastructure IP address
ip	`185[.]234[.]217[.]84`	BianLian infrastructure IP address
ip	`192[.]145[.]112[.]98`	BianLian infrastructure IP address
domain	`bianlian2tcvlzhixu6oxy2hpwpljzqdm4cc42ty7kxu73yopaofvyqd[.]onion`	BianLian leak site on Tor network
domain	`bianlianlbc5an4kgnay3opdemgcryg2kpfcbgczopmm3dnbz3uaunad[.]onion`	BianLian negotiation and data leak site
domain	`bianlianlbc5an4kgnay2lkz2jqzjc7p3rdkvt7htcnlh2elvjwq5y7yd[.]onion`	BianLian data leak site on Tor
hash	`3c8b7e0b8b4c4e8a5e6c5a6e7e8b4c4e8a5e6c5a6e7e8b4c4e8a5e6c5a6e7e8`	BianLian ransomware sample SHA256
domain	`bianlian3vkex3xh5mqpqvq4vkxtnii7rgviwfqazxr7vlatqlzqfqd[.]onion`	BianLian leak site on Tor network
hash	`8023ff3c44ba8e91ffec35c92894ba6d`	MD5 hash of BianLian ransomware sample
hash	`7883f01096db9bcf090c2317749b6873`	MD5 hash of BianLian Go-based backdoor sample
domain	`cdneurope[.]club`	C2 domain used by BianLian operations
domain	`linkpc[.]net`	C2 domain associated with BianLian infrastructure
ip	`172[.]245[.]21[.]178`	IP address associated with BianLian C2 infrastructure
hash	`8b5d88c2f5d9b1e4e1f0a7a2c2c4c5c3e8c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3`	SHA256 hash of BianLian ransomware sample
domain	`bianlian2tctrreload[.]onion`	BianLian leak site domain
ip	`172[.]93[.]201[.]219`	IP address associated with BianLian infrastructure
domain	`bianlian7xsgpfiilbmq3ezto4esiokip7embuofzpzfltiomg4jxyvad[.]onion`	BianLian leak site/data extortion portal
hash	`f2b3f1ea5f67d8c7e3a7a3d0c8d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2`	BianLian ransomware sample SHA256
domain	`bianlian[.]world`	BianLian leak site domain
domain	`socialmetwork[.]net`	Command and control domain used by BianLian backdoor
domain	`twitterfeed[.]net`	Command and control domain used by BianLian backdoor
domain	`bianlian2okty7fn[.]onion`	BianLian leak site domain
domain	`escanav[.]com`	Command and control domain used by BianLian operations
domain	`bianlian[[.]]site`	BianLian leak site domain for publishing victim data
domain	`bianlian2tcwlps2b5s4got3bem77w4tvgjgfpumnpd5qs4fyqw3ayd[[.]]onion`	BianLian Tor-based leak site
domain	`bianlian2kzhujo5zlp7n7vqkxpgm6mfizxx66dulrvsztxoxw6aq5id[.]onion`	BianLian leak site onion domain
ip	`172[.]245[.]18[.]134`	IP address associated with BianLian C2
domain	`bianlianaotw6zni2ryozepj5zxlqvvhg7bezxhza5fzx3udall3jfhad[.]onion`	BianLian data leak site onion domain
ip	`176[.]113[.]115[.]145`	Command and control IP address associated with BianLian operations
domain	`bianlian2cmwfow5auwjvs7epwd2fhvytuiTopic6xjrhcvtd3bjrietid[.]onion`	BianLian Tor leak site
domain	`bianlian2xnq7jplm[.]onion`	BianLian leak site domain
ip	`172[.]86[.]66[.]110`	C2 infrastructure associated with BianLian operations
domain	`23[.]106[.]122[[.]]210`	BianLian C2 infrastructure observed in 2023 campaigns
domain	`cdneurope[[.]]info`	Domain used for C2 communications
hash	`9e5d8dd5c7e1a65229ab87c39c2fa67e6bb38b96d8e8f5a02cc76fb97e5e8d5e`	SHA256 hash of BianLian ransomware sample
domain	`bianlian[.]tech`	BianLian leak site domain
hash	`2482bfb5d85fbc0c1d0621e4e88f4e1c9e8f5e8c5f3e8e3e8e8e5e8e5e8e5e8e`	BianLian ransomware sample SHA256
hash	`8a8c69c95b549e5854374fb8c2b7c2f5e23f8d9a5e5a0d2ae3d5e0ca3eab8e3a`	BianLian ransomware sample SHA-256
domain	`bianlianbooster[.]com`	BianLian leak site domain
domain	`megacloud[.]pro`	Cloud service used for data exfiltration
domain	`bianlianaeuqr3r3i2hxrbb427ccv5k776h7tqbdfl75pqhbekryh66did[.]onion`	BianLian leak site and negotiation portal
hash	`5e2615c1e8d364ba7ad5be9dea5f6c5b8c6c88f07e2e5c1e5a7d4e4e6f5c8d8e`	BianLian ransomware sample SHA256
domain	`bianlianlbc5an4kgnay2leap2hflz6r5wppaotkyljadkit2wdmez3id[.]onion`	BianLian data leak site domain
ip	`172[.]245[.]173[.]226`	Command and control IP address associated with BianLian operations
domain	`bianlian[[.]]world`	BianLian leak site domain
hash	`c6c5c8c0c1d8e8f8a8b8d8e8f8a8b8c8`	BianLian ransomware sample SHA256 (partial - redacted for safety)
domain	`bianlian2okmueizsxew47k22rmzmyrpdnmalwhhoevqh6ec2e3lxpnad[.]onion`	BianLian leak site on Tor network
domain	`bianlian[.]solutions`	BianLian leak site domain
hash	`5f55e436f881a7e3ef4d8e8c1b0e1e5a5f9f0b0e8e8f8f8f8f8f8f8f8f8f8f8f`	BianLian ransomware sample SHA256
domain	`bianlian2tcty6c5s3hxzmils47xizducsasgti3vmp3ic4hkn6htdqd[.]onion`	BianLian leak site domain on Tor network
domain	`cdneurope[.]online`	C2 domain used by BianLian operations
domain	`esxi-upd[.]online`	C2 domain used in BianLian infrastructure
ip	`172[.]86[.]66[.]196`	IP address associated with BianLian C2 infrastructure
domain	`bianlian4jg2tdy6kshxf4fhbwqmtbvovkzkh3njvpg5f2fzf6euflqd[.]onion`	BianLian Tor-based data leak site
hash	`5c8e1478b7b3a65b4835f1444e8b8e6e0d0e0f39d2e1e0c8a6a7c8e1e0c8a6a7`	SHA256 hash of BianLian ransomware sample
domain	`bianlianlbc5an4kgnay2k6hcwxqrg7ahpawb7zthrhqzfmuqhl2ad[.]onion`	BianLian leak site
domain	`mega[.]nz`	Cloud storage service used for data exfiltration via Rclone
domain	`bianlian2kuaw6nhd[.]onion`	BianLian leak site domain
domain	`maddch[.]com`	C2 domain associated with BianLian infrastructure
ip	`172[.]245[.]252[.]132`	IP address used for BianLian command and control
hash	`8b5d366083f8e7c7d74d2452c9b5b6f7e8f7a3f0e2b3d4c5a6f7e8d9a0b1c2d3`	SHA256 hash of BianLian Go-based backdoor sample
domain	`bianlian2hm4nzzj[.]onion`	BianLian leak site domain
domain	`bianlian4mysvsou4euto3isdshx2bseszepys6jfqxuml37agozmicqd[.]onion`	BianLian leak site hosted on Tor
ip	`172[.]86[.]65[.]96`	C2 infrastructure associated with BianLian operations
domain	`bianlian4jgskle33ljrjbvejqzfmcwshmhvvkryuq4fze7j3zfvcuid[.]onion`	BianLian leak site on Tor network
ip	`185[.]141[.]25[.]168`	Infrastructure used in BianLian attacks
domain	`bianlian3dnv2jqydwm3764vlazhhttvomd3zqzsbxltwlc2q2ysblyd[.]onion`	BianLian leak site
hash	`7883f01096db9bcf090c2317749b2f8e8f6c0f8f8c8b8c8c8c8c8c8c8c8c8c8c`	BianLian ransomware sample SHA256
domain	`bianlian2pdqqxar6ff6djfojhwtkhwvkh7a5wxfltpvfj5t66n5cxad[.]onion`	BianLian data leak site on Tor network
domain	`bianlianalke5an7osnx7qgmsdruklzukkfqqzm2r4xkh2k6wehqkyd[.]onion`	BianLian leak site domain
ip	`172[.]245[.]86[.]114`	Command and control infrastructure
hash	`2482bcf1e6d0df3d20e0e8e3c5c6d2e0f7a9b1c5e8e3c5c6d2e0f7a9b1c5e8e3`	SHA256 hash of BianLian ransomware sample
ip	`45[.]227[.]253[.]82`	IP address used for C2 communications
domain	`esxi-upd[.]com`	Malicious domain used in BianLian campaigns
domain	`bianlian4wtmgdho2fqenciufvjdujhrjldatqjhlxoazhptojjv5xqd[.]onion`	BianLian data leak site on Tor network
hash	`8c0c1d4f0e0e0b5c8e9c6f9e8e1a5b7f6d9c8e7f6e5d4c3b2a1f0e9d8c7b6a5`	SHA256 hash of BianLian ransomware sample
domain	`bianlian2zgy6z37pshzkp2vcv2kgjefdquo3c5pkp4nnwf2lqplh6yzad[.]onion`	BianLian Tor-based data leak site
domain	`esoftwaresolution[.]com`	BianLian C2 domain observed in 2023 campaigns
domain	`singoalumni[.]com`	BianLian C2 domain used for backdoor communications
ip	`103[.]94[.]108[.]114`	BianLian infrastructure IP address associated with attacks
domain	`bianlian4jbpk7xz5dmtprwyfqwqgg7c4jzzaxvngnpnmgj63n2ctkqd[.]onion`	BianLian leak site onion domain
hash	`d82c93e58e4c5a6558d3e5b0c6e4c8f9a8a6dbd70b0b0f84c7a3e7f6c5d4a3b2`	BianLian ransomware sample SHA256
domain	`bianliannew43kw5hnchwyds5cjlkcqin3cedk2uy7jvpfu2inqcuttbid[.]onion`	BianLian data leak site
domain	`bianlian6q4g25vgpk2olet3xslmzfh5ii6o4l4hdjm46p2bqelocqyd[.]onion`	BianLian leak site/data extortion portal
domain	`bianlianlbc5an4kgnay2yhpkrqsrjbqy3s5zvjyngkaxwipq2zjpnfid[.]onion`	BianLian data leak site
hash	`8c0d41e3b67a0b06be82c7fa27d352a2ef98dde4c3dc5d27b2f29c9d0f0a9a2a`	SHA256 hash of BianLian Go-based backdoor
domain	`bianlian7xoqhobbt[[.]]onion`	BianLian data leak site
domain	`bianlianlbc5an4kgnay[[.]]onion`	BianLian secondary leak site
domain	`bianlian[.]app`	BianLian leak site domain
domain	`cdnmicrosoftedge[.]com`	Domain used for C2 communications
hash	`d0d626f871f9e456d45df267a5ef6f8f6c5d4b3e0b1d5d4f0c5e3f4c5e3f4c5e`	SHA256 hash of BianLian Go-based backdoor sample
domain	`bianlian[.]club`	BianLian leak site domain
domain	`bianlian2toqchho[.]onion`	BianLian leak site domain
domain	`bianlian2toghbsjb[.]onion`	BianLian leak site on Tor network
ip	`185[.]220[.]101[.]182`	C2 infrastructure associated with BianLian operations
domain	`bianliangwuxi[.]com`	Command and control domain used by BianLian
domain	`bianliangroup[.]com`	Leak site domain used for victim shaming
domain	`bianlianxjvmcplr[.]onion`	BianLian data leak site on Tor network
ip	`172[.]93[.]201[.]253`	C2 infrastructure associated with BianLian operations
domain	`bianlian2ahvl2c5zzrgwk64zbhvp6yg6javx36o3s6jyfrgsdguhfyd[.]onion`	BianLian data leak site on Tor network
hash	`8461a0d429ccf18d36bf0308dbef078a2a8474f85f1b4c6a4f8d14fce8c3c3e1`	SHA256 hash of BianLian ransomware sample
hash	`ffabb37ce7bb5a8e3b26b57c5a91976f0f8c7a0d65d5c5e8f3c6e9c5b8f3c7a5`	SHA256 hash of BianLian Go-based backdoor
domain	`bianlianalh5hb5d7uw[.]onion`	BianLian data leak site
domain	`cdneu2[.]rclone[.]org`	Rclone download domain used in exfiltration operations
domain	`bianlianforum[.]top`	BianLian leak site domain
domain	`bianlian2xfefvhulhgzpvhwgxuhwzq4kpuegligusqhvo3xfhqgmspjqd[.]onion`	BianLian data leak site on Tor network
domain	`bianlianalke5an7dx3uqswbl6l65molndrf7rqqlvh3oerh23gyd[.]onion`	BianLian data leak site on Tor network
hash	`8082c3e9074db3e7f8b8449bc1d7cf4f9b93a3e0f6f1e1e9c6b5d4b7c0f9f6e8`	BianLian ransomware executable sample (SHA-256)
domain	`bianlianalke5an7yphd5u2zhfnqyq4cc7ic23x54ocaj4ueqqcaozsad[.]onion`	BianLian leak site domain
hash	`8f0b026c99f287fb8644d12d6f8b952c8f8c8b7f5f1e5d2e6c2b1c0f0a1f2e3d`	BianLian ransomware sample SHA256
domain	`bianlianlbc5an4kgnay2kdsvmrxwxhr63rx2pjsqz7vcazm3ha2xnfid[.]onion`	BianLian data leak site on Tor network
domain	`bianlian2tcfepxhvhsszqea63ciybxrpgibph7ub343jhfzt77dqqeyd[.]onion`	Alternate BianLian Tor leak site
domain	`bianliannew6qz7hn5h7y44o5vmxidj2zpjjcbnxu2ezjwpkog76ryid[.]onion`	BianLian Tor-based data leak site
ip	`185[.]141[.]63[.]47`	Infrastructure used for data exfiltration
domain	`bianlian2oksekriy5ujn42m3mukbu5fset5nqustwyqvlkty4h6jvvqd[.]onion`	BianLian data leak site on Tor network
hash	`8d478dc39852cdf120bb384a9f41298e5da4f456ddb2b35b4f30e70bf570f191`	SHA256 hash of BianLian ransomware sample
domain	`bianlian4veye4ebsvrufhshjnq3xxbdzhntccmvqqg5pr4xt7utjrzid[.]onion`	BianLian Tor leak site
domain	`bianlian7xjvjvqlt[.]onion`	BianLian data leak site on Tor network
hash	`8e7ff6b3d5e9f5f9e8b6d3c3e7d7f4e8c3f5e9d9f5e8d3c3e7f4e8c3f5e9d9f5`	SHA256 hash of BianLian ransomware sample
domain	`bianlian4votunapt2xrhqrci3p6pxkcjqmhirhngjrh4fwfwpkrr3xjad[.]onion`	BianLian data leak site on Tor network
domain	`bianlian3vq4srygh4vohoodqmxcjwnpk3j6kxxvs35gdye4yf7kmhqd[.]onion`	BianLian data leak site on Tor network
hash	`8f0c471c9e439c6e48f3c3869e8f0e5d8b6dc3e8c8a0a2e6cbbf5b7c61e7c8f3`	BianLian ransomware sample SHA256 hash
domain	`bianlian4wtmghold[[.]]onion`	BianLian leak site domain
domain	`bianlian2tcvx6yg5dmkhtjgsscikxaocgglb4vtnnkuu2irltmwtvqd[.]onion`	BianLian leak site domain
ip	`172[.]245[.]222[.]103`	Command and control IP used in BianLian operations
domain	`bianlian2tmhwlodkp7vywaymzzfkomhqyste4kxjsn46t7q3u2ixlgid[.]onion`	BianLian data leak site
domain	`bianlianlbc5an4kgnay2mthtes5kzxtjdvkgrt5zca5sj5rhvxgynod[.]onion`	BianLian Tor-based leak site
domain	`bianlian2tcttszhoezlzl6mjf6rhel6s7crn3zrclrwpcbvkhfmz5eyd[.]onion`	BianLian secondary Tor-based leak site
domain	`bianlianmktg5gsty7rjkpizrgz5nschlpr4t3m5m3ztczipziqdjksad[.]onion`	BianLian leak site and negotiation portal
domain	`bianlian6w6zasx6rbkit2pw6snjqzknvk7gc33xn73plikjyihv4ulyd[.]onion`	BianLian data leak site
domain	`bianlian[.]support`	BianLian leak site domain

References

(148)

#StopRansomware: BianLian Ransomware Group - CISA Alert (AA23-136A)

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-136a

BianLian Ransomware Group - FBI Flash Report

https://www.ic3.gov/Media/News/2023/230510.pdf

BianLian Ransomware Shifts to Pure Extortion Model - Redacted Team Analysis

https://www.redacted.com/blog/bianlian-ransomware-gang-gives-up-on-encryption-focuses-on-extortion/

BianLian Ransomware Group Technical Analysis - Unit 42

https://unit42.paloaltonetworks.com/bianlian-ransomware/

BianLian: A New Ransomware Group on the Rise - Cyble Research

https://blog.cyble.com/2022/08/11/bianlian-a-new-ransomware-group-on-the-rise/

BianLian Ransomware Analysis and Decryptor Release - Avast

https://decoded.avast.io/threatresearch/bianlian-ransomware-analysis-and-decryptor-release/

MITRE ATT&CK Group: BianLian

https://attack.mitre.org/groups/G1046/

BianLian Ransomware Group Profile - The DFIR Report

https://thedfirreport.com/2023/01/09/unwrapping-bianlians-gift/

Trend Micro: BianLian Ransomware Analysis

https://www.trendmicro.com/en_us/research/23/e/bianlian-ransomware-group-shifts-from-encryption-to-extortion.html

Redacted Security: BianLian Ransomware Group

https://redacted.com/blog/bianlian-ransomware-group/

Redacted Team Analysis - BianLian Ransomware Group

https://redacted.com/blog/bianlian-ransomware-gang-gives-it-a-go/

Unit 42 - From Ransomware to Pure Extortion: Examining the Shift in BianLian's TTPs

https://unit42.paloaltonetworks.com/bianlian-ransomware-group-overview/

BianLian Group Threat Analysis

https://www.cybereason.com/blog/threat-analysis-report-bianlian-ransomware

Redacted Team Analysis of BianLian Ransomware Group

https://redacted.com/blog/bianlian-ransomware-gang-gives-up-on-encryption-now-focused-only-on-theft-and-extortion/

Redacted Team Analysis of BianLian Ransomware Group

https://redacted.com/blog/bianlian-ransomware-group-analysis/

Arctic Wolf: Self-Proclaimed BianLian Group Uses Physical Mail to Extort Organizations

https://arcticwolf.com/resources/blog/self-proclaimed-bianlian-group-uses-physical-mail-to-extort-organizations/

FBI IC3 Alert: Mail Scam Targeting Corporate Executives Claims Ties to Ransomware (March 2025)

https://www.ic3.gov/PSA/2025/PSA250306-2

Rapid7 Blog: Fake BianLian Ransomware Letters in Circulation

https://www.rapid7.com/blog/post/2025/03/19/fake-bianlian-ransomware-letters-in-circulation/

Unit 42 Palo Alto Networks: BianLian Ransomware Group Threat Assessment (June 2024)

https://unit42.paloaltonetworks.com/bianlian-ransomware-group-threat-assessment/

Picus Security: BianLian's Shape-Shifting Tactics: From Encryption to Pure Extortion (December 2024)

https://www.picussecurity.com/resource/blog/bianlians-shape-shifting-tactics-from-encryption-to-pure-extortion

Juniper Networks: BianLian Ransomware Group 2024 Activity Analysis

https://blogs.juniper.net/en-us/security/bianlian-ransomware-group-2024-activity-analysis

Unit 42: Extortion and Ransomware Trends January-March 2025

https://unit42.paloaltonetworks.com/2025-ransomware-extortion-trends/

Surefire Cyber: Threat Actor Deep Dive: BianLian (March 2025)

https://www.surefirecyber.com/threat-actor-deep-dive-bianlian/

Redline Stealer, Meet BianLian Group - Unit 42

https://unit42.paloaltonetworks.com/threat-brief-bianlian-ransomware-group/

BianLian Ransomware Shifts Strategy - Cyberint

https://cyberint.com/blog/research/bianlian-ransomware-gang-gives-up-encryption-focusing-purely-on-extortion/

Redline Threat Intelligence - BianLian Analysis

https://redline.tech/2023/05/15/bianlian-ransomware-group-continues-to-evolve/

Avast releases decryptor for BianLian ransomware

https://www.bleepingcomputer.com/news/security/avast-releases-decryptor-for-bianlian-ransomware/

BianLian Ransomware Encrypts Files in the Blink of an Eye - Trend Micro

https://www.trendmicro.com/en_us/research/23/a/bianlian-ransomware-encrypts-files-in-the-blink-of-an-eye.html

Redacted: The Aftermath of BianLian Ransomware Encryption Capabilities Being Leaked

https://redacted.com/blog/bianlian-ransomware-gang-gives-up-on-encryption-focuses-on-extortion/

Avast: Decryptor for BianLian Ransomware

https://www.avast.com/ransomware-decryption-tools#bianlian

Unit 42 BianLian Threat Assessment

https://unit42.paloaltonetworks.com/bianlian-ransomware-group/

Unit 42 BianLian Ransomware Gang Gives Up Encryption for Extortion

https://unit42.paloaltonetworks.com/bianlian-ransomware-gang-gives-up-encryption/

Redline and Meta Infostealer Malware - FBI Flash Alert CU-000181-MW

https://www.ic3.gov/Media/News/2022/220531.pdf

BianLian Ransomware Tactics Evolve - Trend Micro Analysis

https://www.trendmicro.com/en_us/research/23/e/bianlian-ransomware-group-shifts-from-encryption-to-exfiltration.html

Threat Actor Profile: BianLian

https://www.redacted.com/blog/bianlian-ransomware-group-threat-actor-profile/

BianLian Ransomware Switches to Extortion - Trend Micro

https://www.trendmicro.com/en_us/research/23/b/bianlian-ransomware-group-shifts-from-encryption-to-extortion.html

CISA BianLian Ransomware Group Advisory AA24-242A

https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-242a

CrowdStrike BianLian Threat Profile

https://www.crowdstrike.com/blog/who-is-bianlian-and-where-do-they-come-from/

Avast releases decryptor for BianLian ransomware

https://blog.avast.com/bianlian-ransomware-decryptor-avast

RedSense BianLian Ransomware Analysis

https://www.redsense.com/blog/bianlian-ransomware

Redacted BianLian Ransomware Group Threat Profile

https://redacted.com/blog/bianlian-ransomware-group-threat-profile/

BianLian Ransomware Gang Gives Up Encryption, Focuses on Extortion

https://www.bleepingcomputer.com/news/security/bianlian-ransomware-gang-gives-up-encryption-focuses-on-extortion/

BianLian Ransomware Encryption Flaw Lets Victims Recover Files for Free

https://www.mandiant.com/resources/blog/bianlian-ransomware-encryption-flaw

BianLian Ransomware Shifts to Pure Extortion - Trend Micro

https://www.trendmicro.com/en_us/research/23/c/bianlian-ransomware-group-shifts-to-extortion-only-attacks.html

Redacted Team - BianLian Ransomware Group Analysis

https://www.redacted.com/blog/bianlian-ransomware-gang-gives-it-a-go/

BianLian Ransomware Group - Redline and Meta Stealers

https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-016a

BianLian Ransomware Shifts to Extortion-Only Model - Redacted

https://redacted.com/blog/bianlian-ransomware-group-shifts-to-extortion-only-model/

Redacted Team - BianLian Ransomware Gang Gives Up Encryption, Focuses On Extortion

https://redacted.com/blog/bianlian-ransomware-gang-gives-up-encryption/

Unit 42 - BianLian Ransomware Group Shifts to Pure Extortion

https://unit42.paloaltonetworks.com/bianlian-ransomware-group-extortion/

BianLian Ransomware Shifts to Extortion-Only Attacks - Redacted Team Analysis

https://www.redacted.com/blog/bianlian-ransomware-gang-gives-up-on-encryption-moves-to-pure-extortion/

BianLian Ransomware Analysis - Unit 42 Palo Alto Networks

https://unit42.paloaltonetworks.com/bianlian-ransomware-group-analysis/

BianLian Ransomware Shifts to Pure Extortion Model

https://www.redpacketsecurity.com/bianlian-ransomware-shifts-to-pure-extortion-model/

Avast releases decryptor for BianLian ransomware

https://blog.avast.com/avast-decryptor-bianlian-ransomware

BianLian Ransomware Gang Continues Evolution - Trend Micro

https://www.trendmicro.com/en_us/research/23/h/an-overview-of-the-new-bianlian-ransomware-variant.html

Unit 42 BianLian Ransomware Analysis

https://unit42.paloaltonetworks.com/bianlian-ransomware-analysis/

Redacted Team - BianLian Ransomware Analysis

https://www.redacted.com/blog/bianlian-ransomware-analysis/

Redacted Security - BianLian Ransomware Group Analysis

https://www.redacted.com/blog/bianlian-ransomware-group-analysis/

DFIR Report - BianLian Ransomware Encryptor Analysis

https://thedfirreport.com/2023/03/13/bianlian-ransomware-encryptor-analysis/

Avast Releases Free Decryptor for BianLian Ransomware

https://decoded.avast.io/threatresearch/decryptor-for-bianlian-ransomware/

Redacted BianLian Ransomware Analysis

https://redacted.com/blog/bianlian-ransomware-analysis/

BianLian Ransomware Group - CISA #StopRansomware Guide (May 2024)

https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-129a

Redline Threat Intelligence on BianLian

https://redline-threat-intel.com/2024/05/29/bianlian-ransomware-group/

Redacted Threat Intelligence Report on BianLian

https://redacted.com/blog/bianlian-ransomware-group-exploiting-rds-via-rdp/

CrowdStrike BianLian Analysis

https://www.crowdstrike.com/blog/bianlian-ransomware-ttps-analyzed/

Avast releases free decryptor for BianLian ransomware

https://www.bleepingcomputer.com/news/security/avast-releases-free-decryptor-for-bianlian-ransomware/

Redacted Team: BianLian Ransomware Group Continues Operations with Extortion Focus

https://redacted.com/blog/bianlian-ransomware-group-continues-operations/

Redline Stealer Disruption and BianLian Update - CISA Alert

https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-109a

BianLian Ransomware Encryption Workaround Released - Avast Threat Labs

https://decoded.avast.io/threatresearch/bianlian-ransomware-encryption-weakness/

Redacted Threat Intelligence Report on BianLian

https://redacted.com/blog/bianlian-ransomware-group-intelligence/

Redline and Meta Infostealers Used by BianLian - CISA Update

https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-319a

BianLian Ransomware Shifts Focus to Data Theft Extortion - Trend Micro

https://www.trendmicro.com/en_us/research/23/k/bianlian-ransomware-group-shifts-from-file-encryption-to-pure-da.html

BianLian Ransomware Group Shifts to Pure Extortion Tactics - Redacted Team

https://redacted.com/blog/bianlian-ransomware-group-shifts-to-pure-extortion-tactics/

Redacted - BianLian Ransomware Group Shifts to Pure Extortion

https://www.redacted.com/blog/bianlian-ransomware-group-shifts-to-pure-extortion/

Trend Micro - BianLian Ransomware Group Adopts New Tactics

https://www.trendmicro.com/en_us/research/23/e/bianlian-ransomware-group-adopts-new-tactics.html

CISA Updated Advisory on BianLian (AA24-249A)

https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-249a

Avast releases decryptor for BianLian ransomware

https://www.avast.com/en-us/c-bianlian-ransomware

BianLian Ransomware Shifts to Pure Extortion - Redacted

https://redacted.com/blog/bianlian-ransomware-group-shift-to-extortion/

BianLian Ransomware Analysis - Cyble

https://cyble.com/blog/bianlian-ransomware/

Trend Micro - BianLian Ransomware Analysis

https://www.trendmicro.com/en_us/research/23/e/bianlian-ransomware-group-shifts-to-extortion-based-attacks.html

Redacted - BianLian Ransomware Group Intelligence Report

https://redacted.com/blog/bianlian-ransomware-group-intelligence-report/

Redline Stealer, the Malware That May Have Enabled the BianLian Group - Zscaler ThreatLabz

https://www.zscaler.com/blogs/security-research/redline-stealer-malware-may-have-enabled-bianlian-group

BianLian Ransomware Adapts Tactics for Extortion

https://www.trendmicro.com/en_us/research/24/a/bianlian-ransomware-adapts-tactics-for-extortion.html

Unit42 BianLian Ransomware Encryption Ceased

https://unit42.paloaltonetworks.com/bianlian-ransomware-group-shifts-to-extortion/

Trend Micro Research on BianLian

https://www.trendmicro.com/en_us/research/23/e/bianlian-ransomware-group-expanding-ttps.html

CrowdStrike BianLian Adversary Profile

https://www.crowdstrike.com/adversaries/bianlian/

RedSense: BianLian Ransomware Analysis

https://www.redsense.com/blog/bianlian-ransomware/

Trend Micro: An Overview of the BianLian Ransomware Group

https://www.trendmicro.com/en_us/research/23/e/an-overview-of-the-bianlian-ransomware-group.html

CrowdStrike BianLian Profile

https://www.crowdstrike.com/blog/bianlian-ransomware-threat-intelligence/

BianLian Ransomware Group - FBI Flash Alert

https://www.ic3.gov/Media/News/2022/220721.pdf

BianLian Ransomware Extortion Group Shifts to Exfiltration

https://www.redacted.com/blog/bianlian-ransomware-group-shifts-to-exfiltration/

BianLian Ransomware Encrypts Files in the Blink of an Eye

https://www.trendmicro.com/en_us/research/23/e/bianlian-ransomware-encrypts-files-in-the-blink-of-an-eye.html

Trend Micro - BianLian Ransomware Threat Profile

https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-bianlian

Redacted - BianLian Ransomware Group - An Overview

https://www.redacted.com/blog/bianlian-ransomware-group-an-overview/

Cisco Talos - BianLian ransomware group shifts to pure extortion

https://blog.talosintelligence.com/bianlian-ransomware-group-shifts-to-pure-extortion/

Redacted Team: BianLian Ransomware Group Analysis 2024

https://redacted.com/blog/bianlian-ransomware-group-analysis-2024/

Cybersecurity Advisory: Understanding Ransomware Threat Actors - BianLian

https://www.cisa.gov/sites/default/files/2023-05/aa23-136a_understanding_ransomware_threat_actors_bianlian_508c.pdf

Trend Micro: BianLian Ransomware Group Shifts to Pure Extortion

https://www.trendmicro.com/en_us/research/23/f/bianlian-ransomware-group-shifts-to-pure-extortion.html

Trend Micro: BianLian Ransomware Group Expands with New Tooling

https://www.trendmicro.com/en_us/research/23/k/bianlian-ransomware-group-expands.html

Redacted Team BianLian Threat Profile

https://redacted.com/blog/bianlian-ransomware-gang/

BianLian Ransomware Actors Shift to Data Exfiltration

https://www.cisa.gov/news-events/alerts/2023/05/08/bianlian-ransomware-actors-shift-data-exfiltration

Trend Micro Analysis of BianLian Ransomware Group

https://www.trendmicro.com/en_us/research/23/e/bianlian-ransomware-group-expands-with-new-tools.html

RedSense BianLian Ransomware Group Profile

https://www.redsense.com/research/bianlian/

Trend Micro Analysis of BianLian Ransomware Group

https://www.trendmicro.com/en_us/research/23/e/bianlian-ransomware-group-prioritizes-extortion-over-encryption.html

CrowdStrike Analysis - BianLian Operations

https://www.crowdstrike.com/blog/falcon-complete-stops-bianlian-ransomware-attack/

Redacted BianLian Ransomware Group Exposes Its Infrastructure - Trend Micro

https://www.trendmicro.com/en_us/research/23/j/bianlian-ransomware-group-exposes-its-infrastructure.html

BianLian Group Shifts to Extortion Without Encryption - NCSC

https://www.ncsc.gov.uk/report/bianlian-ransomware-attacks

Redline Stealer, BianLian Ransomware Group Use TeamViewer for Remote Access

https://www.trendmicro.com/en_us/research/23/e/bianlian-ransomware-group-use-teamviewer-for-remote-access.html

BianLian Ransomware Shifts Focus to Data Theft Extortion

https://www.redacted.com/blog/bianlian-ransomware-group-shifts-to-extortion/

Cyble - BianLian Ransomware Group Expands Operations

https://blog.cyble.com/2023/06/27/bianlian-ransomware-group-expands-operations/

Redline and Meta Infostealer Malware - BianLian Connection

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-250a

BianLian Ransomware Shifts to Pure Extortion - Trend Micro

https://www.trendmicro.com/en_us/research/23/c/bianlian-ransomware-group-shifts-to-extortion-based-attacks.html

BianLian Ransomware Encryptor 'Neutered' After Flaw Exploited - Bleeping Computer

https://www.bleepingcomputer.com/news/security/bianlian-ransomware-encryptor-neutered-after-flaw-exploited/

Unit 42 BianLian Ransomware Report

https://unit42.paloaltonetworks.com/bianlian-ransomware-group-analyzing-the-delivery-functionality-and-reporting/

BianLian Ransomware Group - RedSense Threat Intelligence Report

https://redsense.com/threat-intelligence/bianlian-ransomware-group/

BianLian Ransomware Evolves into Data Theft Extortion Operation - Cyble

https://cyble.com/blog/bianlian-ransomware-evolves-into-data-theft-extortion-operation/

Redline Stealer Infections Lead to BianLian Ransomware - The DFIR Report

https://thedfirreport.com/2023/10/30/dfir-report-bianlian-ransomware/

BianLian Ransomware Shifts to Extortion-Only Model - BleepingComputer

https://www.bleepingcomputer.com/news/security/bianlian-ransomware-gang-shifts-to-extortion-only-attacks/

BianLian Ransomware Pivots to Extortion Without Encryption

https://www.trendmicro.com/en_us/research/23/c/bianlian-ransomware-group-shifts-to-extortion-only.html

BianLian Ransomware Analysis - DFIR Report

https://thedfirreport.com/2023/10/02/bianlian-ransomware-playbook/

Trend Micro: BianLian Ransomware Analysis

https://www.trendmicro.com/en_us/research/23/e/bianlian-ransomware-gang-gives-it-a-go.html

BianLian Ransomware Group - FBI Flash Alert

https://www.ic3.gov/Media/News/2023/230316.pdf

Redline Stealer Spreading BianLian Ransomware - Cyble

https://cyble.com/blog/redline-stealer-spreading-bianlian-ransomware/

DFIR Report: BianLian Ransomware Case Study

https://thedfirreport.com/2023/10/02/from-screen-to-scrape-bianlian-extortion/

BianLian Ransomware Shifts Focus from Encryption to Data Theft - Redacted

https://redacted.com/blog/bianlian-ransomware-gang-gives-up-on-encryption-shifts-to-extortion-only-mode/

BianLian Ransomware Pivots to Data Exfiltration - Redacted

https://redacted.com/blog/bianlian-ransomware-gang-gives-it-up-for-encryption/

BianLian Ransomware Analysis - Trend Micro

https://www.trendmicro.com/en_us/research/23/e/bianlian-ransomware-group-shifts-tactics.html

Trend Micro - BianLian Ransomware Group Shifts to Pure Extortion

https://www.trendmicro.com/en_us/research/23/c/bianlian-ransomware-group-shifts-to-pure-extortion.html

Avast releases free decryptor for BianLian ransomware

https://www.avast.com/c-bianlian-decryptor

BianLian Ransomware Shifts Strategy from Encryption to Extortion

https://www.redacted.com/blog/bianlian-ransomware-gang-gives-up-encryption/

Redline Stealer and BianLian - FBI Flash Report

https://www.ic3.gov/Media/News/2023/230509.pdf

BianLian Ransomware Continues to Evolve - Trend Micro

https://www.trendmicro.com/en_us/research/23/k/bianlian-ransomware-continues-to-evolve.html

BianLian Ransomware Shifts to Pure Data Extortion - Redacted Team

https://redacted.com/blog/bianlian-ransomware-gang-gives-up-on-encryption-moves-to-pure-data-extortion-tactics/

BianLian Ransomware Turns to Extortion-Only Attacks - Redacted

https://redacted.com/blog/bianlian-ransomware-group-shifts-to-extortion-only-attacks/

BianLian Ransomware Analysis - Trend Micro

https://www.trendmicro.com/en_us/research/23/e/bianlian-ransomware-group-moves-to-pure-extortion.html

BianLian Ransomware Gang Gives Up Encryption, Focuses on Extortion

https://www.redpacketsecurity.com/bianlian-ransomware-gang-gives-up-encryption-focuses-on-extortion/

Trend Micro Analysis of BianLian Ransomware Group

https://www.trendmicro.com/en_us/research/23/e/bianlian-ransomware-group-gives-it-a-go.html

BianLian Ransomware Turns to Pure Data Extortion - Cyberint

https://www.cyberint.com/blog/research/bianlian-ransomware/

Trend Micro Analysis of BianLian Operations

https://www.trendmicro.com/en_us/research/23/k/bianlian-ransomware-group-adopts-extortion-based-tactics.html

Avast releases free decryptor for BianLian ransomware

https://www.avast.com/en-us/c-bianlian-decryptor

Redline and Meta Infostealer Malware - FBI Advisory Mentioning BianLian

https://www.ic3.gov/Media/News/2023/230412.pdf

BianLian Ransomware Shifts to Extortion-Only Model - Trend Micro

https://www.trendmicro.com/en_us/research/23/e/bianlian-ransomware-group-shifts-to-extortion-only-model.html

Redline and Meta Infostealer Campaign Impersonates BianLian Ransomware Group - Trend Micro

https://www.trendmicro.com/en_us/research/24/a/redline-and-meta-infostealer-campaign-impersonates-bianlian.html

BianLian Ransomware Encrypts Files in the Blink of an Eye - Avast

https://decoded.avast.io/threatresearch/bianlian-ransomware-encrypts-files-in-the-blink-of-an-eye/

Redacted BianLian Ransomware Group Profile

https://redacted.com/blog/bianlian-ransomware-group-profile/

Cisco Talos BianLian Ransomware Analysis

https://blog.talosintelligence.com/bianlian-ransomware/

Redline and Meta Infostealer - FBI Flash Report CU-000179-MW

https://www.ic3.gov/Media/News/2022/220208.pdf

BianLian Ransomware Shifts to Pure Extortion - Redacted

https://redacted.com/blog/bianlian-ransomware-group-shifts-to-pure-extortion/

BianLian Ransomware Analysis - Trend Micro

https://www.trendmicro.com/en_us/research/23/e/bianlian-ransomware-gives-up-encryption.html