What is BianLian ransomware?

BianLian is a criminal group that started as a ransomware operation in June 2022 and moved to pure data-theft extortion. CISA, the FBI and the Australian Cyber Security Centre described it in joint advisory AA23-136A of 16 May 2023; the advisory says the group shifted to primarily exfiltration-based extortion around January 2023, and a November 2024 update says it moved to exclusively exfiltration-based extortion around January 2024. Its actors typically get in with valid remote-desktop credentials, often obtained from initial access brokers or through phishing, then use built-in tools and remote-access software to explore the network and copy data out before demanding payment. Because nothing is encrypted, a victim may only learn of the attack from the extortion message. That makes outbound data monitoring especially relevant, because the theft is the attack. The advisory recommends strictly limiting remote desktop, auditing remote-access tools and keeping administrative accounts under tight control.

← All 25 questions on Ransomware groups and familiesAll topics