Loading story…
WatchGuard researchers identified a phishing campaign attributed to the BianLian ransomware group that heavily targets companies in Venezuela with emails in Spanish posing as routine business correspondence. The messages carry malicious .svg attachments disguised as invoices or other business documents; when opened, the files trigger outbound connections to attacker-controlled infrastructure and ultimately download a Go-based Windows payload. The operation uses ja.cat shortened links and compromised Brazilian domains to redirect victims to the final malware, helping the campaign blend in and evade detection.
Researchers said the payload shows clear ransomware behavior, including rapid file encryption with AES, and includes multiple anti-analysis checks such as detecting Wine, monitoring system suspension events, and inspecting settings like GODEBUG. The findings highlight how seemingly benign SVG image files can be weaponized for initial access, and WatchGuard urged defenders to monitor or block the suspicious domains tied to the campaign and scrutinize invoice-themed attachments delivered by email.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
WatchGuard published research describing the SVG-based phishing campaign, its ransomware behavior including rapid AES file encryption, and suspicious domains defenders should block or monitor. The disclosure warned that seemingly harmless SVG files can be weaponized in real-world attacks.
The campaign's SVG attachments triggered connections to external URLs, using ja.cat shortened links and compromised Brazilian domains to redirect victims to a final Go-based Windows payload. Researchers also observed anti-analysis checks including Wine detection, suspension monitoring, and inspection of settings such as GODEBUG.
WatchGuard researchers identified a phishing campaign heavily targeting companies in Venezuela and attributed it to the BianLian ransomware group based on the observed tactics. The emails used malicious SVG attachments disguised as routine Spanish-language business documents such as invoices.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**BianLian** emerged as a Go-based ransomware family targeting organizations in manufacturing, education, healthcare, and BFSI, with victims reporting file encryption and double-extortion threats. The malware appends the `.bianlian` extension to encrypted files, drops a ransom note named **"Look at this instruction.txt"**, and warns that allegedly stolen financial, client, business, technical, and personal data will be leaked within ten days unless payment is made through negotiations conducted over TOX Messenger and a Tor-based leak site. Technical analysis shows the malware was built to hinder detection and speed impact on victim systems. BianLian performs anti-analysis checks associated with **MITRE ATT&CK `T1497`** virtualization and sandbox evasion, creates multiple threads to accelerate encryption, enumerates drives from `A:` through `Z:`, excludes selected files and folders from encryption, and deletes itself after execution. Its behavior also aligns with broader defense-evasion patterns such as executable obfuscation and packing captured in **MITRE ATT&CK `T1027.002`**, underscoring how the ransomware combines rapid file encryption with techniques intended to frustrate automated analysis and reverse engineering.
Aug 15, 2026
The **BianLian** ransomware group increased its operational tempo and rapidly expanded its command-and-control infrastructure, with researchers linking the activity to a relatively new threat actor using custom **Go-based** malware, including a backdoor and encryptor. The group had been active since late 2021 and, by early September 2022, had posted **20 victims** to its leak site, underscoring its use of **double extortion**. Victims were concentrated in **North America, the UK, and Australia**, while targeting spanned sectors including **manufacturing, healthcare, and education**, with manufacturing receiving particular attention. Investigators said BianLian commonly gained initial access by exploiting the **ProxyShell** vulnerability chain, targeting **SonicWall VPN** devices, and attempting to use weak or exposed remote-access credentials. Once inside, the operators relied heavily on living-off-the-land techniques such as **RDP**, **WinRM**, **WMI**, **PowerShell**, `net.exe`, `netsh.exe`, and `reg.exe` for reconnaissance, lateral movement, and persistence, before turning more aggressive during encryption by disabling or bypassing defenses including **Windows Defender**, **AMSI**, and **Sophos** protections. Researchers assessed the group as technically capable at network intrusion and stealthy expansion, but comparatively immature in extortion operations due to operational mistakes and unreliable victim communications.
Aug 15, 2026
A sophisticated phishing campaign has been identified targeting users in Colombia by impersonating official judicial notifications from the 17th Municipal Civil Court of the Bogotá Circuit. The attackers crafted emails in Spanish, leveraging local institutional details to increase the credibility of the lure. The phishing emails claim to contain a lawsuit notification and prompt recipients to open an attached SVG file. This SVG file is weaponized to initiate a multi-stage infection chain. Upon opening, the SVG file triggers the execution of a malicious HTA (HTML Application) file, which is a common technique for bypassing traditional email security filters. The HTA file then executes a VBS (Visual Basic Script) file, which in turn runs a PowerShell script. This PowerShell script acts as a downloader and loader, ultimately injecting the AsyncRAT remote access trojan into a legitimate Windows process to evade detection. AsyncRAT is a well-known remote access tool that allows attackers to gain persistent control over infected systems, exfiltrate data, and potentially deploy additional payloads. The campaign employs anti-virtual machine techniques to avoid analysis and uses persistence mechanisms to maintain access on compromised hosts. Security researchers have observed that the use of SVG files for initial infection is increasing, as these files can bypass some security controls due to their perceived harmlessness. The campaign demonstrates a high level of technical sophistication, chaining multiple scripting languages and file types to obfuscate the attack and evade endpoint detection. The malicious files have been identified and their MD5 hashes documented for threat intelligence sharing. Detection signatures have been updated by security vendors such as Quick Heal and Seqrite to identify and block the components of this attack. The campaign is notable for its targeted approach, focusing on Colombian users and leveraging local judicial terminology to increase the likelihood of success. The use of AsyncRAT as the final payload provides attackers with extensive capabilities for surveillance, data theft, and further lateral movement within affected organizations. Security teams are advised to educate users about the risks of opening unexpected attachments, especially those purporting to be from legal or government institutions. Organizations should also ensure that email security solutions are updated to detect SVG-based threats and that endpoint protection is capable of identifying the multi-stage infection chain. The incident highlights the evolving tactics of threat actors in using file formats and social engineering tailored to specific regions and institutions.
Jun 29, 2026