BianLian
Attribution profile
- Type
- Criminal
- Location
- China
- Known incidents
- 21 incidents
- Sources
- 22 sources
- First seen
- 2022-06-30
- Last seen
- 2024-07-31
- Updated
- 2026-10-13 11:44
- Aliases
- 2 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
BianLian (also tracked as BianLain) is a ransomware group assessed to be based in China that conducts financially motivated extortion operations. The group has been observed targeting a wide range of sectors including healthcare, education, insurance, media, critical infrastructure, mining and conglomerates, with victims located in the United States, India, Spain and other countries. Its primary objective is monetary gain through exfiltration‑based extortion, threatening to leak stolen data unless a ransom is paid. BianLian’s tactics include gaining initial access via valid Remote Desktop Protocol credentials, deploying custom backdoors written in Go, installing remote management tools, creating local administrator accounts, and using PowerShell and Windows Command Shell to disable antivirus software and modify registry settings. Once inside, the actors enumerate networks and Active Directory, harvest credentials for lateral movement, locate sensitive files with PowerShell scripts, and exfiltrate them using FTP, Rclone or Mega services. Files are often encrypted with a .bianlian extension and a ransom note is left; the group also applies additional pressure such as printing ransom notes on compromised printers and making threatening phone calls. Publicly reported operations include the July 2024 intrusion at Fresnillo, the September 2023 attack on Save the Children International, the June 2023 claim against the Piramal Group, and the March 2023 breach of Parques Reunidos Group. No public sources link BianLian to a state sponsor or a larger criminal consortium.
Incidents
Attributed incidents are available to members.
21 incidentsSources
Sources available to members: 22 sources.