BianLian
Attribution profile
- Type
- Criminal
- Location
- United States of America
- Known incidents
- 4 incidents
- Sources
- 0 sources
- First seen
- 2020-03-01
- Last seen
- 2023-04-04
- Updated
- 2026-10-12 18:53
- Aliases
- 1 alias
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
BianLian, also tracked as the d0nut ransomware group, is a financially motivated threat actor based in the United States. The group primarily targets healthcare institutions, legal services providers, and web hosting companies, seeking monetary gain through data exfiltration and ransom demands. Observed tactics include gaining initial access via phishing emails or exploiting unpatched Microsoft Exchange vulnerabilities, deploying ransomware to encrypt files, and stealing sensitive data such as personally identifiable information, financial records, and source code for double‑extortion pressure. BianLian has been linked to ransomware incidents against a legal firm (UnitedLex), a hospital (Montgomery General Hospital), a healthcare business associate (OneDigital), and a major hosting provider where source code was stolen and malware installed to redirect customer sites. No public attribution to a state sponsor or larger criminal consortium has been established.
Incidents
Attributed incidents are available to members.
4 incidentsSources
Sources available to members: 0 sources.