Cybercrime high Russia (assessed)

BianLian

CISA assesses the group as likely Russia-based, with multiple Russia-based affiliates — an assessment, not a confirmed identity. No alternate vendor tracking name located. · Financial — pure data-theft extortion (no longer encrypts)

Reports 1

Active Since June 2022

Last Reported 11 Sept 2026

Sectors Targeted professional-services, healthcare, manufacturing, critical-infrastructure

Tactics, Techniques & Procedures (TTPs)

Initial access via compromised/valid RDP creds (likely access brokers), phishing, ProxyShell (CVE-2021-34473/34523/31207), CVE-2022-37969
Custom Go-based backdoor built per-victim; legitimate remote-access tools; Ngrok; modified Rsocks
SessionGopher, Advanced Port Scanner, SharpShares, PingCastle for discovery; Impacket secretsdump.py, LSASS dumping for credentials
Exfiltration via FTP/Rclone/Mega — pivoted away from AES-256/CBC encryption to pure extortion since January 2024
Extortion via Tor leak site, Tox IDs, onionmail.org addresses; ransom notes printed to compromised network printers; threats to notify clients/regulators

Known Targets

Professional services (~24% of claimed victims), healthcare (~17%), manufacturing (~15%)Multiple US critical infrastructure sectors and Critical Manufacturing (CISA)Australian critical infrastructure, professional services, property development (ACSC)

Analyst Notes

Shifted from double extortion to encryption-free data-theft extortion starting ~January 2023 (coinciding with Avast's free decryptor release), exclusively data-theft since January 2024 per CISA's November 2024 advisory update. No law enforcement disruption reported to date. A third-party tracker showed zero new victims in the trailing 30 days as of October 2026 — a possible lull, unconfirmed cause. The FBI separately warned (March 2025) of fraudulent physical letters impersonating BianLian with no actual compromise behind them — verify evidence of real exfiltration before treating any BianLian-branded claim as confirmed.

Also Known As

No confirmed alternate vendor name identified

MITRE ATT&CK Techniques

T1133 External Remote Services T1078 Valid Accounts T1190 Exploit Public-Facing Application T1003 OS Credential Dumping T1041 Exfiltration Over C2 Channel

Intelligence Reports

Analysis professional-serviceshealthcare

BianLian Stopped Encrypting Files Years Ago. It's Still Collecting Victims — and Now Impersonators Too

BianLian abandoned encryption for pure data-theft extortion back in 2023. CISA's last confirmed update was November 2024, no law enforcement action has followed, and the FBI has had to warn separately about fraudsters mailing fake BianLian ransom letters.

11 Sept 2026 · 8 min read