Threat Actor Characterization
You’re viewing the read-only version.
Sign in for analyst tools (editors, promote draft, file/relations management, etc.)
BianLian Ransomware
ID: 39d34ed11faace68869f7f654a25d27926875
Crimeware
Ransomware
Threat types: Ransomware, Intrusion, Exfiltration
Progress: 69%
Completeness: 68%
Freshness: 70%
Operation zone: United States
Aliases
Limited alias preview
| BianLian | BianLian Group | Bi************* | Bi*********************** |
| Bi********* | — | — | — |
Showing 2 of 5 aliases in free preview.
Actor Network Graph
Open Network GraphMITRE ATT&CK®
confidence: high
BianLian — transitioned from ransomware to pure data-theft extortion in 2023; living-off-the-land and RDP-heavy operations.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1078 | Valid Accounts | TA0001 TA0003 TA0004 TA0005 |
|
| T1041 | Exfiltration Over C2 Channel | TA0010 |
|
| T1486 | Data Encrypted for Impact | TA0040 |
|
BianLian Ransomware Group — Data-Theft Extortion
CLASSIFICATION: Unclassified / Open Source
Executive Summary
BianLian emerged in 2022 with a Go-based ransomware but pivoted in 2023 to primarily data-theft-only extortion (encryption optional/rare). Operations rely on valid accounts/RDP, living-off-the-land tactics, thorough discovery, bulk exfiltration, and staged leak-site pressure. Confidence: high.
Closed, profit-motivated crew with Tor leak infrastructure; opportunistic and sector-agnostic targeting across regions.
Objective: monetize stolen data (pure extortion). Public shaming and staged disclosures increase pressure on victims.
Executive brief
now
Saved successfully.
Hunting Playbook
now
Saved successfully.
IOC Appendix
now
Saved successfully.
OSINT Library
now
Saved successfully.