Loading story…
The BianLian ransomware group increased its operational tempo and rapidly expanded its command-and-control infrastructure, with researchers linking the activity to a relatively new threat actor using custom Go-based malware, including a backdoor and encryptor. The group had been active since late 2021 and, by early September 2022, had posted 20 victims to its leak site, underscoring its use of double extortion. Victims were concentrated in North America, the UK, and Australia, while targeting spanned sectors including manufacturing, healthcare, and education, with manufacturing receiving particular attention.
Investigators said BianLian commonly gained initial access by exploiting the ProxyShell vulnerability chain, targeting SonicWall VPN devices, and attempting to use weak or exposed remote-access credentials. Once inside, the operators relied heavily on living-off-the-land techniques such as RDP, WinRM, WMI, PowerShell, net.exe, netsh.exe, and reg.exe for reconnaissance, lateral movement, and persistence, before turning more aggressive during encryption by disabling or bypassing defenses including Windows Defender, AMSI, and Sophos protections. Researchers assessed the group as technically capable at network intrusion and stealthy expansion, but comparatively immature in extortion operations due to operational mistakes and unreliable victim communications.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
On September 2, 2022, RH-ISAC published a report highlighting BianLian's August 2022 infrastructure growth and increased attack rate, along with indicators and behavioral detections tied to the group's encryptor and backdoor samples.
On September 1, 2022, researchers published a technical analysis describing BianLian as a relatively new ransomware group using custom Go-based malware, ProxyShell and SonicWall exploitation for access, and living-off-the-land techniques for lateral movement and defense evasion. The report also noted that 20 victims had been posted on the group's leak site as of that date.
During August 2022, researchers observed BianLian rapidly expanding its command-and-control infrastructure to roughly 30 active IPs and increasing its operational tempo. The activity was associated with targeting multiple sectors including manufacturing, healthcare, and education.
Infrastructure associated with the BianLian ransomware operation first appeared in December 2021, and researchers assessed its toolset to have been under active development since that time.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks Unit 42 published a threat assessment of **BianLian**, describing a financially motivated cybercrime group that has shifted from traditional ransomware deployment toward **data theft and extortion**. The group has targeted organizations across multiple sectors and is known for gaining initial access through valid remote access credentials and exposed services, then moving laterally, escalating privileges, and exfiltrating sensitive data before pressuring victims to pay. The assessment says BianLian has used a flexible intrusion playbook that includes remote desktop and VPN access, hands-on-keyboard activity, and the use of legitimate administrative tools to blend into victim environments. The report highlights the group’s evolution from encrypting systems to emphasizing **double extortion** and notes that defenders should focus on hardening remote access, monitoring for credential abuse, and detecting suspicious lateral movement and data exfiltration tied to the actor’s operations.
Jul 12, 2026
**BianLian** emerged as a Go-based ransomware family targeting organizations in manufacturing, education, healthcare, and BFSI, with victims reporting file encryption and double-extortion threats. The malware appends the `.bianlian` extension to encrypted files, drops a ransom note named **"Look at this instruction.txt"**, and warns that allegedly stolen financial, client, business, technical, and personal data will be leaked within ten days unless payment is made through negotiations conducted over TOX Messenger and a Tor-based leak site. Technical analysis shows the malware was built to hinder detection and speed impact on victim systems. BianLian performs anti-analysis checks associated with **MITRE ATT&CK `T1497`** virtualization and sandbox evasion, creates multiple threads to accelerate encryption, enumerates drives from `A:` through `Z:`, excludes selected files and folders from encryption, and deletes itself after execution. Its behavior also aligns with broader defense-evasion patterns such as executable obfuscation and packing captured in **MITRE ATT&CK `T1027.002`**, underscoring how the ransomware combines rapid file encryption with techniques intended to frustrate automated analysis and reverse engineering.
Aug 15, 2026
Royal ransomware emerged as a major threat after first being observed in September 2022, with intrusions linked to likely Russian-speaking cybercrime actors and possible overlap with former **Conti** members. The group has hit organizations globally, including multiple Australian victims and critical infrastructure, with a concentration of cases in the United States and Canada across healthcare, manufacturing, education, and government. Royal operators steal data before encrypting systems, then pressure victims through leak-site exposure and, in some cases, social media harassment; reported ransom demands have reached **$25 million** in bitcoin. Analysts also identified infrastructure and tooling overlaps between Royal activity, **FRwL / UAC-0118**, and earlier ex-Conti-linked operations, including shared IPs and a **Cobalt Strike** watermark associated with related campaigns. Investigations show Royal gains initial access through callback phishing, SEO poisoning, malicious downloads, phishing links sent via website contact forms, exploitation of unpatched vulnerabilities, exposed **RDP**, and compromised credentials. After entry, the actors have used **BATLOADER**, **Qakbot**, **Bokbot**, **Cobalt Strike**, **PsExec**, **PowerShell**, **AdFind**, **NetScan**, **Chisel**, **Rclone**, **PCHunter**, **PowerTool**, and **Process Hacker** to move laterally, evade defenses, exfiltrate data, and deploy ransomware on Windows as well as a Linux/**ESXi** ELF variant. Royal typically encrypts local drives and network shares, appends the `.royal` extension, deletes shadow copies, disables security services, and leaves `README.txt` ransom notes with Tor-based contact instructions. Defenders are urged to prioritize **software patching**, multifactor authentication, network segmentation, traffic filtering, application allowlisting, privileged account controls, and offline encrypted backups to reduce exposure to the exploitation and credential abuse techniques seen in Royal intrusions.
Aug 15, 2026