BianLian
activeAlso known as: BianLian Ransomware
BianLian is a ransomware group written in Go that shifted from encryption-based attacks to pure data extortion in early 2023 after a decryptor was released. They focus on exfiltrating data and threatening publication.
First Seen
2022-06
Last Activity
2025-01
Target Regions
3 regions
Industries
5 sectors
HealthcareProfessional ServicesManufacturingEducationMedia
Attack Chain (MITRE ATT&CK)
Visual representation of the attack phases and techniques used by BianLian
Click on a phase to view details and MITRE ATT&CK technique IDs
Tactics & Techniques
MITRE ATT&CK mapped tactics and techniques used by this threat actor
Indicators of Compromise (IOCs)
Known IOCs associated with BianLian operations
| Type | Value | Description | Last Seen | Actions |
|---|---|---|---|---|
| hash | b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9 | BianLian Go-based backdoor | 2025-01-08 | |
| domain | bianlianxxxxxxx[.]onion | Tor leak site | — |
IOCs are defanged for safety. Click copy to get the clean value.
Detection Guidance
SIEM and EDR detection recommendations for identifying BianLian activity
- 1Monitor for rclone execution
- 2Detect mega.io upload activity
- 3Alert on unusual RDP access patterns
- 4Monitor for Go-based process execution
Mitigation, Containment & Recovery
Step-by-step guidance for responding to and recovering from this ransomware attack
- 1Audit RDP access and credentials
- 2Block data exfil to cloud storage
- 3Isolate compromised systems