BianLian

BianLian emerged in June 2022 and has affected organizations across multiple US critical-infrastructure sectors, with CISA assessing the group as likely based in Russia with Russia-based affiliates. It initially used a double-extortion model (encrypt after exfiltration) but shifted primarily to exfiltration-based extortion around January 2023 and to exclusively data-theft extortion around January 2024.

Documented tradecraft (per CISA/FBI/ASD's ACSC #StopRansomware advisories, originally May 2023 and updated through 2024) includes gaining access via valid RDP credentials and exploitation of internet-facing systems, exploitation of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) with web shell installation on Exchange, and use of tools such as Rclone, Mega and FTP for data exfiltration. The group pressures victims with threats to publish stolen data on its leak site.

BianLian has remained active into 2025 and continues to appear in extortion tracking. In a MENA context it has an associated claim involving Bahrain. As with all leak-site listings, individual victim claims should be treated as unverified unless independently confirmed by a reputable source or the affected organization.