BianLian is a
cybercriminal
Cybercrime encompasses a wide range of criminal activities that are carried out using digital devices and/or networks. It has been variously defined as "a crime committed on a computer network, especially the Internet"; Cybercriminals may explo ...
ransomware
Ransomware is a type of malware that Encryption, encrypts the victim's personal data until a ransom is paid. Difficult-to-trace Digital currency, digital currencies such as paysafecard or Bitcoin and other cryptocurrency, cryptocurrencies are com ...
group, presumably based in Russia, which has targeted
Critical National Infrastructure (CNI) in the US and private enterprises in Australia and the UK since June 2022,
specializing since 2023 in encryption-based extortion.
(It had previously used the more labor-intensive
double-extortion model.) Valid
Remote Desktop Protocol
Remote Desktop Protocol (RDP) is a proprietary protocol developed by Microsoft Corporation which provides a user with a graphical interface to connect to another computer over a network connection. The user employs RDP client software for this pu ...
credentials are used to gain access to systems.
On 20 November 2024,
FBI
The Federal Bureau of Investigation (FBI) is the domestic Intelligence agency, intelligence and Security agency, security service of the United States and Federal law enforcement in the United States, its principal federal law enforcement ag ...
,
United States’ Cyber Security and Infrastructure Security Agency (CISA) and the
Australian Cyber Security Centre
The Australian Cyber Security Centre (ACSC), the successor to the Cyber Security Operations Centre, is the Australian Government's lead agency for cyber security. The ACSC is part of the Australian Signals Directorate and is based at the Austr ...
(ACSC) released a joint security advisory concerning the BianLian group.
Such has been its noterierty that on 6 March 2025 the FBI and its
Internet Crime Complaint Center
The Internet Crime Complaint Center (IC3) is a division of the Federal Bureau of Investigation (FBI) concerning suspected Internet-facilitated criminal activity. The IC3 gives victims a convenient and easy-to-use reporting mechanism that alerts ...
(IC3) issued an advisory bulletin about unknown actors claiming to
be BianLian.
See also
*
Conti (ransomware)
Conti is malware developed and first used by the Russia-based hacking group "Wizard Spider" in December, 2019. It has since become a full-fledged Ransomware as a service, ransomware-as-a-service (RaaS) operation used by numerous threat actor gro ...
References
Cybercrime
Organizations established in 2022
Ransomware
Security breaches
{{malware-stub