Executive Summary
BianLian has been running continuous extortion operations since June 2022, but the operation that exists today looks meaningfully different from the one CISA, the FBI, and Australia’s ACSC first described. The group started as a conventional double-extortion ransomware crew, encrypting files with AES-256 in CBC mode while also stealing data. Starting around January 2023 — not coincidentally, the same window in which Avast released a free decryptor for BianLian’s encryptor — the group began shifting toward extortion without encryption at all: steal the data, threaten to leak it, skip the step that a free tool could undo. The joint advisory’s November 2024 update states the group has relied exclusively on this data-theft model since January 2024. No law enforcement action against BianLian has been reported through this writing, and a third-party victim tracker shows no new victims in the trailing 30 days as of mid-October 2026 — though that single data point is nowhere near sufficient to call the group inactive. Complicating the picture further, the FBI issued a separate warning in March 2025 about scammers mailing fraudulent letters that falsely claim to be from BianLian, with no actual compromise behind them — a reminder that not every “BianLian” claim reaching a victim’s mailroom is real.
Origins and Attribution
CISA assesses BianLian as likely Russia-based, with multiple Russia-based affiliates involved in operations — an assessment, not a certainty, and the advisory doesn’t name a specific individual or organization behind it. No alternate vendor tracking designation (an equivalent to a Mandiant UNC-number or a Microsoft Storm name) surfaced in available reporting, which is itself notable; most ransomware operations of this profile and duration pick up at least one competing tracking name along the way. One thing worth flagging explicitly: there is an unrelated Android banking trojan that also goes by “BianLian,” dating to 2019. It has nothing to do with this ransomware operation beyond sharing a name — a collision worth being careful about if cross-referencing older threat intelligence.
The Shift Away From Encryption
The decision to drop encryption is the single most consequential fact about this group’s current risk profile, and it’s worth being precise about the timeline. The group continued to encrypt some victims through late 2023 even after Avast’s decryptor became available — meaning the pivot was gradual, not an immediate reaction. By CISA’s account, the group had moved to data-theft/extortion exclusively by January 2024, and the November 2024 advisory update reaffirms that as the current operating model. Practically, this means a BianLian intrusion today is unlikely to present as a classic ransomware event with locked files and a demand note on every desktop. It presents as a quiet data-exfiltration breach that surfaces only when the extortion attempt begins — which changes what detection should be watching for: large outbound transfers and unusual remote-access tool usage matter more than encryption-event indicators for this specific actor.
How BianLian Gets In and Moves
CISA’s advisory lists compromised or valid RDP credentials — likely obtained through access brokers — phishing, and exploitation of the ProxyShell Exchange vulnerability chain (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) as initial access methods, along with CVE-2022-37969 and at least one documented case involving the Netlogon vulnerability CVE-2020-1472. Once inside, the group deploys a custom Go-based backdoor built per-victim — one observed sample was named “def.exe” — alongside legitimate remote-access software and Ngrok for tunneling, plus a modified version of Rsocks. For discovery and lateral movement, the toolkit includes SessionGopher, Advanced Port Scanner, SoftPerfect Network Scanner, SharpShares, PingCastle, RDP Recognizer, and Impacket’s secretsdump.py script, along with LSASS credential dumping and PsExec for execution. Tools are UPX-packed to resist signature detection, and the group has used webshells on compromised Exchange servers as a foothold. Exfiltration runs through FTP, Rclone, or Mega.
The extortion mechanics are distinctive even by ransomware-crew standards. Victims are contacted through a Tor leak site, Tox messaging IDs, and email addresses on the onionmail.org domain. In some cases, ransom notes have been printed directly to compromised network printers inside the victim’s own office — a deliberately unsettling touch — and employees have reportedly received threatening phone calls. The group has also threatened to notify a victim’s clients, business partners, and regulators directly if payment isn’t made, extending pressure beyond the breached organization itself.
Who’s Being Hit
A third-party aggregator (Proven Data, pulled October 19, 2026) puts cumulative claimed victims at 552 across 24 countries, with professional services at roughly 24% of the total, healthcare at 17%, and manufacturing at 15%. CISA’s advisory separately notes targeting across multiple US critical infrastructure sectors and Critical Manufacturing specifically, while ACSC describes Australian targeting concentrated in critical infrastructure and private enterprise, professional services, and property development. No specific named victim with a confirmed 2026 incident date surfaced in research for this piece — older named healthcare claims exist in press coverage from 2023, but attaching them to current 2026 risk would overstate what’s actually documented.
The Impersonation Problem
In March 2025, the FBI, via a Rapid7 advisory, warned that fraudsters have been sending physical letters to companies falsely claiming to be from BianLian and demanding Bitcoin payment — with no actual network compromise behind the claim. This matters operationally: a “BianLian” ransom demand reaching an organization doesn’t automatically mean BianLian, or any real intrusion, is involved. Incident response teams receiving an extortion claim bearing this name should verify evidence of actual data access or exfiltration before treating it as a confirmed compromise, precisely because this particular brand name has already been used as cover for letters with nothing behind them.
Status, Late 2026
No CISA, FBI, or ACSC advisory update specific to BianLian postdating November 2024 was located for this piece — the joint advisory remains the authoritative reference nearly two years on. Huntress’s threat profile explicitly notes no law enforcement disruption or arrests have been reported against the group to date. The Proven Data snapshot showing zero new victims in the prior 30 days is a single-source, point-in-time signal and should be read as exactly that — a possible lull, with no confirmed cause, not a declared end of operations.
What This Means
BianLian’s extortion-without-encryption model is a useful case study in how ransomware economics evolve around specific defensive wins: a free decryptor didn’t stop the group, it just removed the reason to keep using the encryptor. For defenders, the practical implication is that absence of encryption-event alerts doesn’t mean absence of a BianLian-style intrusion — exfiltration volume, backdoor persistence, and credential-dumping activity are the signals that matter for this actor now. And for incident response teams specifically, verify before you believe: between a genuinely quiet operation and a wave of copycat extortion letters invoking its name, “BianLian” on a demand note is not self-authenticating evidence of anything.