Loading story…
BianLian emerged as a Go-based ransomware family targeting organizations in manufacturing, education, healthcare, and BFSI, with victims reporting file encryption and double-extortion threats. The malware appends the .bianlian extension to encrypted files, drops a ransom note named "Look at this instruction.txt", and warns that allegedly stolen financial, client, business, technical, and personal data will be leaked within ten days unless payment is made through negotiations conducted over TOX Messenger and a Tor-based leak site.
Technical analysis shows the malware was built to hinder detection and speed impact on victim systems. BianLian performs anti-analysis checks associated with MITRE ATT&CK T1497 virtualization and sandbox evasion, creates multiple threads to accelerate encryption, enumerates drives from A: through Z:, excludes selected files and folders from encryption, and deletes itself after execution. Its behavior also aligns with broader defense-evasion patterns such as executable obfuscation and packing captured in MITRE ATT&CK T1027.002, underscoring how the ransomware combines rapid file encryption with techniques intended to frustrate automated analysis and reverse engineering.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Cyble reported that the Go-based BianLian ransomware family was first identified around mid-July 2022.
By the time of Cyble's report, BianLian had reportedly targeted at least nine organizations in manufacturing, education, healthcare, and BFSI sectors. The campaign used double extortion, combining file encryption with threats to leak stolen data.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
blog.cyble.com
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **BianLian** ransomware group increased its operational tempo and rapidly expanded its command-and-control infrastructure, with researchers linking the activity to a relatively new threat actor using custom **Go-based** malware, including a backdoor and encryptor. The group had been active since late 2021 and, by early September 2022, had posted **20 victims** to its leak site, underscoring its use of **double extortion**. Victims were concentrated in **North America, the UK, and Australia**, while targeting spanned sectors including **manufacturing, healthcare, and education**, with manufacturing receiving particular attention. Investigators said BianLian commonly gained initial access by exploiting the **ProxyShell** vulnerability chain, targeting **SonicWall VPN** devices, and attempting to use weak or exposed remote-access credentials. Once inside, the operators relied heavily on living-off-the-land techniques such as **RDP**, **WinRM**, **WMI**, **PowerShell**, `net.exe`, `netsh.exe`, and `reg.exe` for reconnaissance, lateral movement, and persistence, before turning more aggressive during encryption by disabling or bypassing defenses including **Windows Defender**, **AMSI**, and **Sophos** protections. Researchers assessed the group as technically capable at network intrusion and stealthy expansion, but comparatively immature in extortion operations due to operational mistakes and unreliable victim communications.
Aug 15, 2026
Palo Alto Networks Unit 42 published a threat assessment of **BianLian**, describing a financially motivated cybercrime group that has shifted from traditional ransomware deployment toward **data theft and extortion**. The group has targeted organizations across multiple sectors and is known for gaining initial access through valid remote access credentials and exposed services, then moving laterally, escalating privileges, and exfiltrating sensitive data before pressuring victims to pay. The assessment says BianLian has used a flexible intrusion playbook that includes remote desktop and VPN access, hands-on-keyboard activity, and the use of legitimate administrative tools to blend into victim environments. The report highlights the group’s evolution from encrypting systems to emphasizing **double extortion** and notes that defenders should focus on hardening remote access, monitoring for credential abuse, and detecting suspicious lateral movement and data exfiltration tied to the actor’s operations.
Jul 12, 2026
WatchGuard researchers identified a phishing campaign attributed to the **BianLian** ransomware group that heavily targets companies in Venezuela with emails in Spanish posing as routine business correspondence. The messages carry malicious `.svg` attachments disguised as invoices or other business documents; when opened, the files trigger outbound connections to attacker-controlled infrastructure and ultimately download a Go-based Windows payload. The operation uses `ja.cat` shortened links and compromised Brazilian domains to redirect victims to the final malware, helping the campaign blend in and evade detection. Researchers said the payload shows clear ransomware behavior, including rapid file encryption with **AES**, and includes multiple anti-analysis checks such as detecting **Wine**, monitoring system suspension events, and inspecting settings like `GODEBUG`. The findings highlight how seemingly benign SVG image files can be weaponized for initial access, and WatchGuard urged defenders to monitor or block the suspicious domains tied to the campaign and scrutinize invoice-themed attachments delivered by email.
Jun 29, 2026