Loading malware…
BianLian is a name used for two distinct malware contexts: a Go-based ransomware and extortion operation targeting enterprise environments, and an unrelated Android banking malware family. In enterprise intrusions, BianLian emerged as a ransomware actor using custom Go malware including a backdoor and an encryptor. It has been observed gaining initial access through exploitation of ProxyShell vulnerabilities, attacks on SonicWall VPN appliances, and abuse of weak or exposed remote-access credentials. After access, operators rely heavily on living-off-the-land techniques such as RDP, WinRM, WMI, and PowerShell for reconnaissance, lateral movement, persistence, and defense evasion. Reported behaviors include disabling or bypassing security controls, modifying firewall and remote-access settings, deleting backups and shadow copies, exfiltrating data with common administrative tools, and deploying a custom backdoor that can retrieve and execute payloads in memory. BianLian initially operated as a double-extortion ransomware, but by early 2023 it was widely reported to have shifted toward exfiltration-based extortion without file encryption. Victims have included organizations in manufacturing, healthcare, education, information and communications, and other sectors, with activity concentrated in North America, the United Kingdom, and Australia.
Separately, Android/BianLian is a banking trojan family first publicly discussed in 2018 and primarily associated with campaigns targeting Turkish banking and financial applications, later expanding to additional regions and app categories including cryptocurrency services. This Android malware abuses Accessibility Services, hides its icon, dynamically loads secondary components, and communicates with command-and-control infrastructure over HTTP. Its modular capabilities include SMS interception and sending, overlay-based credential theft, USSD execution, device locking, notification suppression, PIN theft or manipulation, screen capture or screencasting, remote app installation, and TeamViewer-assisted remote access. Some variants also implement SOCKS5 or SSH proxy functionality and retrieve updated command-and-control information from remote intermediary services. Because the same name is used for both the enterprise extortion malware and the Android banking trojan, analysts should distinguish them carefully; available reporting has explicitly noted no observed operational connection between the Android banking malware and the BianLian ransomware group.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
7 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The BianLian group has successfully targeted the ProxyShell vulnerability chain (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) to gain initial access into victim networks. | The BianLian group has developed a custom tool set consisting of a backdoor and an encryptor, developing both using the Go programming language.
The BianLian group has successfully targeted the ProxyShell vulnerability chain (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) to gain initial access into victim networks. | The BianLian group has developed a custom tool set consisting of a backdoor and an encryptor, developing both using the Go programming language.
The BianLian group has successfully targeted the ProxyShell vulnerability chain (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) to gain initial access into victim networks. | The BianLian group has developed a custom tool set consisting of a backdoor and an encryptor, developing both using the Go programming language.
CVE-2024–27198: A vulnerability in JetBrains software leveraged by BianLian for data extortion operations. While not directly Qilin, it shows the types of software vulnerabilities targeted by sophisticated RaaS groups. | CVE-2024–27198: A vulnerability in JetBrains software leveraged by BianLian for data extortion operations.
SAP NetWeaver, a cornerstone for enterprise operations across countless global organizations, faces a severe threat from a newly discovered deserialization vulnerability, CVE-2025-42980. With a CVSS score of 9.1, this flaw could enable attackers to execute arbitrary code... Threat Intelligence Active exploitation by ransomware groups, including BianLian and Ransomexx, has been observed.
First observed in attacks in June 2022, BianLian was seen targeting critical infrastructure organizations and private entities in the US and abroad. The group has been stealing victim data, using it for extortion.
First observed in attacks in June 2022, BianLian was seen targeting critical infrastructure organizations and private entities in the US and abroad. The group has been stealing victim data, using it for extortion.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The BianLian group has developed a custom tool set consisting of a backdoor and an encryptor, developing both using the Go programming language.
38 distinct techniques documented for this family, organized by ATT&CK tactic.
MITRE TTPs Redacted researchers provided the following MITRE ATT&CK tactics, techniques, and procedures: ID Technique T1047 Execution: Windows Management Instrumentation
MITRE TTPs Redacted researchers provided the following MITRE ATT&CK tactics, techniques, and procedures: ID Technique T1078 Persistence: Valid Accounts
Credential Access: Account manipulation via net.exe “Net user” is too loud to alert on in most environments, but we recommend alerting on a threshold of “net user” executions.
Defense Evasion: Reg.exe modifying safeboot keys BianLian added a remote access tool to safeboot keys in order to enable network access for their remote access tool in safeboot.
MITRE TTPs Redacted researchers provided the following MITRE ATT&CK tactics, techniques, and procedures: ID Technique T1078 Persistence: Valid Accounts
Credential Access: Account manipulation via net.exe “Net user” is too loud to alert on in most environments, but we recommend alerting on a threshold of “net user” executions.
the first thing the application does is hide its icon and constantly requests permission to abuse Accessibility services functionalities until granted. Once these are obtained, it initiates all of its modules.
At a first look, it seemed clear that the APK was heavily obfuscated... It seems to mostly rely on generating a variety of random functions to hide the real functionalities of the sample... Most of the strings in the code are generated by using functions implementing a XOR decryption of byte arrays.
The malware does not use DexClassLoader to unpack the payload DEX. Instead it loads the payload as a secondary DEX through multidex support. The packer re-implements multidex support and mainly changes names & adds asset decryption.
be on the lookout for... a botnet with tags such as “grim” that poses as a “Security” application ... Android banking trojans typically pose as famous applications: Video Player, Play Store, Flash Player, etc.
The same component also deals with removal of applications... If the package name is “bot”, then the bot removes itself. A self “cleaning” command!
MITRE TTPs Redacted researchers provided the following MITRE ATT&CK tactics, techniques, and procedures: ID Technique T1078 Persistence: Valid Accounts
From attachBaseContext, the malware calls a cascade of functions which (1) locate an asset named G9ugwFtlG1.jwi, (2) deflates it and (3) finally decrypts it using a home-made algorithm with hard coded key...
Upon execution of the ransomware, it attempts to identify if the file is running in a WINE environment by checking the wine_get_version() function via the GetProcAddress() API.
Reconnaissance: Ping -4 -n 1 BianLian used single pings to perform network reconnaissance.
MITRE TTPs Redacted researchers provided the following MITRE ATT&CK tactics, techniques, and procedures: ID Technique T1069 Discovery: Permission Groups Discovery
MITRE ATT&CK® Techniques ... Discovery T1082 T1083 T1518 T1120 System Information Discovery File and Directory Discovery Security Software Discovery Peripheral Device Discovery
MITRE TTPs Redacted researchers provided the following MITRE ATT&CK tactics, techniques, and procedures: ID Technique T1021.005 Lateral Movement: Remote Services: VNC
Lateral Movement: Winrm dropping a file via PowerShell The binary wsmprovhost.exe is used to mediate the relationship between WinRM and PowerShell. Alerting on file modification by wsmprovhost.exe proved a reliable method to detect BianLian dropping malicious files.
The BianLian sample installs fine on Android 8. The (fake) server BianLian communicates to a C&C via HTTP. | BianLian communicates to a C&C via HTTP.
MITRE TTPs Redacted researchers provided the following MITRE ATT&CK tactics, techniques, and procedures: ID Technique T1071.001 Command and Control: Application Layer Protocol: Web Protocol
This module is used to create a functioning SSH server on the device using JSCH... BianLian can setup a proxy that can run SSH sessions using remote port forwarding on port 34500, with an implementation similar to 2017’s malware MilkyDoor, making communication with the CC harder to detect.
160 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
76 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware family mentioned as possibly linked to the crypting actor hiddenroot.
Ransomware family mentioned as one of the criminal services hosted by Aeza Group infrastructure.
Financially motivated ransomware group that opportunistically targets multiple sectors and publishes stolen data on the dark web.
Ransomware family identified by the FBI as one of the biggest ransomware threats by complaint volume in 2025.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.