Skip to content
brandefense.io
Request A Demo
RansomwareFinancialAdvanced sophistication · Organisation

BianLian

BianLian is a ransomware group with a financial motive, tracked by Brandefense. It targets 19 sectors, including Government and Technology, in 29 countries, including the United States and the United Kingdom. It uses 99 MITRE ATT&CK techniques and exploits 13 known CVEs.

Also known as
  • BianLian Team
Request IOC feedRequest ATT&CK export
Techniques
99
Exploited CVEs
13
First seen
May 24, 2023
Last seen
Dec 9, 2025
Record updated

Who They Target.

Sectors · 19
Countries · 29
Labelsbianliandata-extortionexfiltration-only-extortionmegaransomwarercloneremote-access-software

How They Operate · MITRE ATT&CK.

99 techniques across 14 of 14 tactics

Reconnaissance7

T1012
Query Registry
T1033
System Owner/User Discovery
T1046
Network Service Discovery
T1069
Permission Groups Discovery
T1071.001
Application Layer Protocol: Web Protocols
T1082
System Information Discovery
T1135
Network Share Discovery

Resource Development2

T1587
Develop Capabilities
T1587.001
Develop Capabilities: Malware

Initial Access15

T1021.001
Remote Services: Remote Desktop Protocol
T1021.004
Remote Services: SSH
T1076
Remote Desktop Protocol
T1078
Valid Accounts
T1078.002
Valid Accounts: Domain Accounts
T1091
Replication Through Removable Media
T1133
External Remote Services
T1190
Exploit Public-Facing Application
T1195
Supply Chain Compromise
T1210
Exploitation of Remote Services
T1505.003
Server Software Component: Web Shell
T1557
Adversary-in-the-Middle
T1566
Phishing
T1566.001
Phishing: Spearphishing Attachment
T1566.002
Phishing: Spearphishing Link

Execution14

T1021
Remote Services
T1053
Scheduled Task/Job
T1053.005
Scheduled Task/Job: Scheduled Task
T1059
Command and Scripting Interpreter
T1059.001
Command and Scripting Interpreter: PowerShell
T1059.003
Command and Scripting Interpreter: Windows Command Shell
T1059.005
Command and Scripting Interpreter: Visual Basic
T1059.007
Command and Scripting Interpreter: JavaScript
T1105
Ingress Tool Transfer
T1218.011
System Binary Proxy Execution: Rundll32
T1219
Remote Access Tools
T1485
Data Destruction
T1569.002
System Services: Service Execution
T1570
Lateral Tool Transfer

Persistence9

T1098
Account Manipulation
T1112
Modify Registry
T1136
Create Account
T1136.001
Create Account: Local Account
T1505
Server Software Component
T1543
Create or Modify System Process
T1543.003
Create or Modify System Process: Windows Service
T1547.001
Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
T1547.009
Boot or Logon Autostart Execution: Shortcut Modification

Privilege Escalation2

T1068
Exploitation for Privilege Escalation
T1548.002
Abuse Elevation Control Mechanism: Bypass User Account Control

Defense Evasion22

T1027
Obfuscated Files or Information
T1027.001
Obfuscated Files or Information: Binary Padding
T1027.002
Obfuscated Files or Information: Software Packing
T1027.003
Obfuscated Files or Information: Steganography
T1036
Masquerading
T1036.003
Masquerading: Rename Legitimate Utilities
T1036.004
Masquerading: Masquerade Task or Service
T1036.005
Masquerading: Match Legitimate Resource Name or Location
T1045
Software Packing
T1070.004
Indicator Removal: File Deletion
T1074
Data Staged
T1090
Proxy
T1090.002
Proxy: External Proxy
T1102
Web Service
T1115
Clipboard Data
T1490
Inhibit System Recovery
T1497.001
Virtualization/Sandbox Evasion: System Checks
T1552.001
Unsecured Credentials: Credentials In Files
T1562
Impair Defenses
T1562.001
Impair Defenses: Disable or Modify Tools
T1562.004
Impair Defenses: Disable or Modify System Firewall
T1562.006
Impair Defenses: Indicator Blocking

Credential Access9

T1003
OS Credential Dumping
T1003.001
OS Credential Dumping: LSASS Memory
T1003.003
OS Credential Dumping: NTDS
T1029
Scheduled Transfer
T1069.002
Permission Groups Discovery: Domain Groups
T1528
Steal Application Access Token
T1537
Transfer Data to Cloud Account
T1552
Unsecured Credentials
T1555.003
Credentials from Password Stores: Credentials from Web Browsers

Discovery7

T1016.001
System Network Configuration Discovery: Internet Connection Discovery
T1018
Remote System Discovery
T1083
File and Directory Discovery
T1087
Account Discovery
T1087.001
Account Discovery: Local Account
T1087.002
Account Discovery: Domain Account
T1482
Domain Trust Discovery

Lateral Movement1

T1021.002
Remote Services: SMB/Windows Admin Shares

Collection4

T1005
Data from Local System
T1020
Automated Exfiltration
T1113
Screen Capture
T1114.001
Email Collection: Local Email Collection

Command and Control2

T1071
Application Layer Protocol
T1573.002
Encrypted Channel: Asymmetric Cryptography

Exfiltration4

T1041
Exfiltration Over C2 Channel
T1048
Exfiltration Over Alternative Protocol
T1567
Exfiltration Over Web Service
T1567.002
Exfiltration Over Web Service: Exfiltration to Cloud Storage

Impact1

T1486
Data Encrypted for Impact

Vulnerabilities They Exploit.

Browse Vulnerability Intelligence →
CVE-2022-37042Synacor Zimbra Collaboration Suite (ZCS) contains an authentication bypass vulnerability in MailboxImportServlet.ExploitedcriticalCVE-2023-27350PaperCut MF/NG contains an improper access control vulnerability within the SetupCompleted class that allows authentication bypass and code execution in the context of system.ExploitedcriticalCVE-2023-42793JetBrains TeamCity contains an authentication bypass vulnerability that allows for remote code execution on TeamCity Server.ExploitedcriticalCVE-2024-27198JetBrains TeamCity contains an authentication bypass vulnerability that allows an attacker to perform admin actions.ExploitedcriticalCVE-2025-31324SAP NetWeaver Visual Composer Metadata Uploader contains an unrestricted file upload vulnerability that allows an unauthenticated agent to upload potentially malicious executable…ExploitedcriticalCVE-2021-34473Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution.ExploitedcriticalCVE-2025-42999SAP NetWeaver Visual Composer Metadata Uploader contains a deserialization vulnerability that allows a privileged attacker to compromise the confidentiality, integrity, and…ExploitedcriticalCVE-2021-34523Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation.ExploitedcriticalCVE-2021-4034The Red Hat polkit pkexec utility contains an out-of-bounds read and write vulnerability that allows for privilege escalation with administrative rights.ExploitedhighCVE-2022-37969Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.ExploitedhighCVE-2022-27925Synacor Zimbra Collaboration Suite (ZCS) contains flaw in the mboximport functionality, allowing an authenticated attacker to upload arbitrary files to perform remote code…ExploitedhighCVE-2021-31207Microsoft Exchange Server contains an unspecified vulnerability that allows for security feature bypass.ExploitedmediumCVE-2020-1472Microsoft's Netlogon Remote Protocol (MS-NRPC) contains a privilege escalation vulnerability when an attacker establishes a vulnerable Netlogon secure channel connection to a…Exploitedmedium

Other linked vulnerabilities

Linked to BianLian in Brandefense intelligence, without evidence of exploitation in the wild.

CVE-2025-30012The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component, which allows an unauthenticated attacker to send malicious payload…criticalCVE-2025-42963A critical vulnerability in SAP NetWeaver Application server for Java Log Viewer enables authenticated administrator users to exploit unsafe Java object deserialization.criticalCVE-2025-42964SAP NetWeaver Enterprise Portal Administration is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a…criticalCVE-2025-42966SAP NetWeaver XML Data Archiving Service allows an authenticated attacker with administrative privileges to exploit an insecure Java deserialization vulnerability by sending a…criticalCVE-2025-42980SAP NetWeaver Enterprise Portal Federated Portal Network is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially…critical

Linked through malware and tools

Targeted by malware or tools BianLian uses; not reported as exploited by the actor itself.

CVE-2021-44228Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.ExploitedcriticalCVE-2024-57726SimpleHelp contains a missing authorization vulnerability that could allow low-privileged technicians to create API keys with excessive permissions.ExploitedcriticalCVE-2023-22515Atlassian Confluence Data Center and Server contains a broken access control vulnerability that allows an attacker to create unauthorized Confluence administrator accounts and…ExploitedcriticalCVE-2023-22518Atlassian Confluence Data Center and Server contain an improper authorization vulnerability that can result in significant data loss when exploited by an unauthenticated attacker.ExploitedcriticalCVE-2023-22527Atlassian Confluence Data Center and Server contain an unauthenticated OGNL template injection vulnerability that can lead to remote code execution.ExploitedcriticalCVE-2025-22457Ivanti Connect Secure, Policy Secure, and ZTA Gateways contains a stack-based buffer overflow vulnerability that allows a remote unauthenticated attacker to achieve remote code…ExploitedcriticalCVE-2021-26855Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution.ExploitedcriticalCVE-2024-21887Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure contain a command injection vulnerability in the web components of these products…ExploitedcriticalCVE-2023-46805Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure gateways contain an authentication bypass vulnerability in the web component that…ExploitedhighCVE-2024-21893Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure), Ivanti Policy Secure, and Ivanti Neurons contain a server-side request forgery (SSRF) vulnerability in the…ExploitedhighCVE-2024-21412Microsoft Windows Internet Shortcut Files contains an unspecified vulnerability that allows for a security feature bypass.ExploitedhighCVE-2017-0199Microsoft Office and WordPad contain an unspecified vulnerability due to the way the applications parse specially crafted files.ExploitedhighCVE-2023-38831RARLAB WinRAR contains an unspecified vulnerability that allows an attacker to execute code when a user attempts to view a benign file within a ZIP archive.ExploitedhighCVE-2025-29824Microsoft Windows Common Log File System (CLFS) Driver contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.ExploitedhighCVE-2024-57727SimpleHelp remote support software contains multiple path traversal vulnerabilities that allow unauthenticated remote attackers to download arbitrary files from the SimpleHelp…ExploitedhighCVE-2024-57728SimpleHelp contains a path traversal vulnerability that allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e.ExploitedhighCVE-2022-41328Fortinet FortiOS contains a path traversal vulnerability that may allow a local privileged attacker to read and write files via crafted CLI commands.ExploitedhighCVE-2025-24983Microsoft Windows Win32 Kernel Subsystem contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.ExploitedhighCVE-2025-21590Juniper Junos OS contains an improper isolation or compartmentalization vulnerability.ExploitedmediumCVE-2025-29814Improper authorization in Microsoft Partner Center allows an authorized attacker to elevate privileges over a network.high

Arsenal · Malware And Tools.

  • Akira ransomwaremalware
  • BianLianmalware
  • BianLian Encryptormalware
  • BianLian Go Backdoormalware
  • Black Bastamalware
  • BlackCatmalware
  • hivemalware
  • Linux-based backdoormalware
  • LockBit 2.0malware
  • Medusa Ransomwaremalware
  • Phobosmalware
  • PipeMagicmalware
  • Royalmalware
  • system.exemalware
  • Advanced Port Scannertool
  • AnyDesktool
  • Atera Agenttool
  • Brute Ratel C4tool
  • Google Go Programming Languagetool
  • Impackettool
  • Megatool
  • MSBuildtool
  • ngroktool
  • PingCastletool
  • PsExectool
  • PTC FlexPLMtool
  • PTC Windchilltool
  • Rclonetool
  • RDP Recognizertool
  • rs64.exetool
  • Rsockstool
  • SessionGophertool
  • SharpSharestool
  • SoftPerfect Network Scannertool
  • Splashtoptool
  • TeamViewertool
  • Winetool

Campaigns.

  1. BianLian Data-Extortion OperationsJun 2022 to Jun 2024

Indicators Of Compromise.

TLP:AMBER
  • Hash93fb7f0c2cf10fb5885e03c737ee8508816c1102e9e3d358160b78e91fa1ebdb
  • Hash183b28fb93db1c907b32aa9fa2f83c7b0ebcc6724de85707a89e5d03c5be5d12

108 more indicators on the Brandefense platform

IP, domain and hash indicators · YARA rules · ATT&CK Navigator export

Request A Demo

About BianLian.

BianLian ransomware operations began in late 2021. The group practices multi-pronged extortion, demanding payment for a decryptor, as well as the non-release of stolen data. The ransomware group hosts a public, TOR-based, blog to post victim identities and stolen data. Somewhat unique to BianLian at the time of their launch was their inclusion of an I2P mirror for their blog.

Last updated Sep 22, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.