The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) have released an updated joint advisory as part of their ongoing efforts to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors.
Specifically, the agencies are releasing the advisory to disseminate known BianLian ransomware and data extortion group indicators of compromise, as well as tactics, techniques, and procedures identified through FBI and ACSC investigations.
BianLian is a ransomware developer, deployer, and data extortion cybercriminal group, likely based in Russia, with multiple Russia-based affiliates.
The reporting agencies are aware of multiple ransomware groups, like BianLian, that seek to misattribute location and nationality by choosing foreign-language names, almost certainly to complicate attribution efforts.
BianLian group actors have affected organisations in multiple US critical infrastructure sectors since June 2022. They have also targeted Australian critical infrastructure sectors in addition to professional services and property development.
The group gains access to victim systems through valid Remote Desktop Protocol credentials, uses open-source tools and command-line scripting for discovery and credential harvesting, and exfiltrates victim data via File Transfer Protocol , Rclone, or Mega.
BianLian then extorts money by threatening to release data if payment is not made. BianLian group originally employed a double-extortion model in which they encrypted victims’ systems after exfiltrating the data. However, they shifted primarily to exfiltration-based extortion. Around January 2023 and shifted to exclusively exfiltration-based extortion around January 2024.
FBI, CISA, and ACSC encourage critical infrastructure organisations and small- and medium-sized organisations to implement the recommendations in the Mitigations section of this advisory to reduce the likelihood and impact of BianLian and other ransomware and data extortion incidents.
You can read the full advisory on the Australian Cyber Security Centre website.
