Overview
BianLian ransomware operations began in late 2021. The group practices multi-pronged extortion, demanding payment for a decryptor, as well as the non-release of stolen data. The ransomware group hosts a public, TOR-based, blog to post victim identities and stolen data. Somewhat unique to BianLian at the time of their launch was their inclusion of an I2P mirror for their blog.
- First tracked: 2022-07-14
- Discussed in our reports: Bahrain
What public reporting says
- A joint FBI, CISA and Australian ACSC advisory describes BianLian as likely based in Russia with Russia-based affiliates, and notes that groups pick foreign-language names to muddy attribution. Since January 2024 it has relied on data theft alone, without encryption.
Australian ACSC · FBI IC3 advisory
Geography: origin and targets
Assessed origin: Russian Federation. A joint FBI, CISA and ACSC advisory describes the group as likely based in Russia, with Russia-based affiliates. Attribution is uncertain: read it as an assessment, not proof.
United States of America167
Canada15
India12
United Kingdom8
Australia8
Italy3
Germany3
Sweden3
Singapore3
Indonesia3
Exploited vulnerabilities
| Vendor | Product | CVE | Category | Source |
|---|---|---|---|---|
| JetBrains | TeamCity | CVE-2024-27198 | Applications | www.guidepointsecurity.com |
| JetBrains | TeamCity | CVE-2023-42793 | Applications | www.guidepointsecurity.com |
| SAP | NetWeaver | CVE-2025-31324 | Applications | reliaquest.com |
| Windows | NetLogon | CVE-2020-1472 | Microsoft | cisa.gov, cisa.gov, cisa.gov, cisa.gov, cisa.gov, thedfirreport.com, thedfirreport.com, cisa.gov, cisa.gov, welivesecurity.com, cisa.gov, thedfirreport.com, checkpoint.com |
ATT&CK techniques
Columns are ATT&CK tactics; each cell is a technique reported for this group in public sources. A technique appearing here means it has been reported for the group, not that it was used in any particular incident, and an empty cell is not evidence that the group does not use it.
Technique details
Execution (TA0002)
- T1059 · Command and Scripting Interpreter: Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.
- T1204 · User Execution: An adversary may rely upon specific actions by a user in order to gain execution.
Defense Evasion (TA0005)
- T1027.002 · Software Packing: Adversaries may perform software packing or virtual machine software protection to conceal their code.
- T1036 · Masquerading: Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.
- T1497 · Virtualization/Sandbox Evasion: Adversaries may employ various means to detect and avoid virtualization and analysis environments.
Discovery (TA0007)
- T1082 · System Information Discovery: An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.
- T1083 · File and Directory Discovery: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
- T1120 · Peripheral Device Discovery: Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.
- T1518.001 · Security Software Discovery: Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment.
Lateral Movement (TA0008)
- T1091 · Replication Through Removable Media: Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes.
Impact (TA0040)
- T1486 · Data Encrypted for Impact: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
Tools
- RDP Recognizer
- Advanced IP Scanner
- Advanced Port Scanner
- PingCastle
- SharpShares
- SoftPerfect NetScan
- WKTools
- MEGA
- RClone
- PsExec
- Impacket
- AmmyyAdmin
- AnyDesk
- Atera
- ScreenConnect
- Splashtop
- TeamViewer
Leak-site infrastructure
| Title | Type | Address (defanged) | Seen online at snapshot |
|---|---|---|---|
| — | DLS | bianliaoxoeriowgqohcly4a6sbkpc3se2yvxgidxomxlpuhx5ehrpad[.]onion | No |
| BianLian | Home | DLS | bianlivemqbawcco4cx4a672k2fip3guyxudzurfqvdszafam3ofqgqd[.]onion | No |
| BianLian | Home | DLS | bianlianlbc5an4kgnay3opdemgcryg2kpfcbgczopmm3dnbz3uaunad[.]onion | No |
Sources and caveats
Group descriptions, ATT&CK mappings, tools and leak-site locations come from public ransomware tracking projects, including ransomware.live and Crocodyli. Exploited vulnerabilities come from the Ransomware-Vulnerability-Matrix by BushidoUK (licensed CC BY 4.0), supplemented where a group profile there is newer than the data we hold. Each CVE links to its original research source. Technical text is shown in English as published. Leak-site addresses are defanged and shown for blocking and detection; do not visit them. Nothing here is verified by ClairSec_ against a specific incident.
Data snapshot: 2026-10-11