Bianlian ransomware group

BianLian ransomware first appeared in June 2022 as a Go-based crypto-locker but pivoted in January 2023 to a pure data-extortion model after security firms released free decryptors for early versions. In its initial phase, it used AES-256 + RSA-2048 hybrid encryption, appending the .bianlian extension to files and dropping ransom notes with Tor links. The group targets a broad set of industries—healthcare, education, government, critical manufacturing, and professional services—with confirmed victims in the U.S., U.K., Australia, and Canada. Initial access is often obtained via compromised RDP credentials, exploitation of vulnerabilities in internet-facing systems, or use of stolen VPN credentials from infostealers. Post-compromise, BianLian conducts network reconnaissance, credential harvesting, and exfiltration of sensitive files before issuing extortion threats on its leak site. The group has claimed responsibility for dozens of breaches, with ransom demands often in the $100k–$2 million USD range.