All Threat Groups ID: bianlian
Monitored (Active Archive) 600 Victims Disclosed Bian Lian RSS Feed

Bianlian Syndicate Dossier

First Intercepted
2022-07-14
Latest Disclosure
2025-03-31
Victim Velocity
1.0 / claim

Threat Profile & Operational Narrative

Debuting in June 2022 with a custom Go-based encryptor, BianLian strategically shifted in early 2023 to an extortion-only model focusing on massive data theft rather than file locking following public decryptor availability. The syndicate targets healthcare, legal, manufacturing, and financial organizations primarily situated in the United States and Europe. Gaining entry through compromised RDP/VPN credentials and unpatched perimeter vulnerabilities, operators exfiltrate gigabytes of proprietary records before threatening public disclosure and directly harassing enterprise clients.

Tactics, Techniques & Procedures (MITRE ATT&CK)

T1190: Exploit Public-Facing Application T1078: Valid Accounts T1133: External Remote Services T1059.001: PowerShell T1059.003: Windows Command Shell T1021.001: Remote Desktop Protocol T1083: File and Directory Discovery T1560.001: Archive via Utility T1562.001: Disable or Modify Tools T1567.002: Exfiltration to Cloud Storage

Known Dark Web Infrastructure & Mirrors

bianlianlbc5an4kgnay3opdemgcryg2kpfcbgczopmm3dnbz3uaunad.onion
OFFLINE
bianlivemqbawcco4cx4a672k2fip3guyxudzurfqvdszafam3ofqgqd.onion
OFFLINE
bianliaoxoeriowgqohcly4a6sbkpc3se2yvxgidxomxlpuhx5ehrpad.onion
OFFLINE

Disclosed Victims & Incident Archive (600)

Disclosed Victim Organization Sector Country
2025-03-31 CMC Technology Group General --
2025-03-31 Meridian Senior General --
2025-03-31 Saunders and Saunders General --
2025-03-31 Sonrisas Dental Health General --
2025-03-22 Goshen Medical Center General --
2025-03-07 Allworx General --
2025-03-07 Minnesota Orthodontics General --
2025-03-04 Layfield and Borel CPA's L.L.C General --
2025-03-04 Brien, Inc. General --
2025-03-04 Keystone Pacific Property Management LLC General --
2025-03-04 Mosley Glick O’Brien, Inc. General --
2025-03-04 Garner, P.C. General --
2025-03-04 Legal Aid Society of Salt Lake General --
2025-03-04 Ewald Consulting General --
2025-02-25 Island Realty General --
2025-02-19 Alabama Ophthalmology Associates General --
2025-02-13 Aspire Rural Health System General --
2025-02-13 Ball, LLP General --
2025-02-13 R Molds Inc General --
2025-02-13 Borel CPA's L.L.C General --
2025-02-13 Dain, Torpy, Le Ray, Wiest and Garner, P.C. General --
2025-02-13 Nippon Steel USA General --
2025-02-13 Financial Services of America, Inc. General --
2025-02-13 Layfield & Borel CPA's L.L.C General --
2025-02-13 Dain, Torpy, Le Ray, Wiest & Garner, P.C. General --
2025-02-10 Recievership Specialists General --
2025-02-05 Dash Business General --
2025-02-05 Hall Chadwick General --
2025-02-05 NESCTC Security Services General --
2025-02-05 St Clair Orthopaedics and Sports Medicine P.C. General --
2025-02-05 OFW Law General --
2025-02-04 C and R Molds Inc General --
2025-02-04 C & R Molds Inc General --
2025-02-04 Commercial Solutions General --
2025-02-02 Cyrious Software General --
2025-02-02 Medical Associates of Brevard General --
2025-02-02 Civic Committee General --
2025-02-02 Ayres Law Firm General --
2025-02-02 Growth Acceleration Partners General --
2025-01-18 MassDevelopment General --
2025-01-16 Fish Nelson and Holden General --
2025-01-13 Nash Brothers Construction General --
2025-01-07 D-7 Roofing General --
2024-12-26 Caframo Limited. General --
2024-12-26 Associates General --
2024-12-18 Cottrell Fletcher & Cottrell P.C. General --
2024-12-18 Giordano, DelCollo, Werb & Gagne, LLC. General --
2024-12-18 Cottrell P.C. General --
2024-12-18 Gagne, LLC. General --
2024-12-14 TWRU CPAs and Financial Advisors General --
2024-12-14 American Computer Estimating Inc General --
2024-12-14 MedRevenu Inc General --
2024-12-14 Mid Florida Primary Care General --
2024-12-10 Throat General --
2024-12-10 Global Insurance Agency LLC General --
2024-12-10 Physicians' Primary Care of Southwest Florida General --
2024-12-06 LTI Trucking Services General --
2024-12-05 Star Shuttle Inc. General --
2024-12-01 Alpine Ear Nose & Throat General --
2024-12-01 Alpine Ear Nose and Throat General --
2024-11-26 Goodman, P.A. General --
2024-11-26 TWRU CPAs & Financial Advisors General --
2024-11-22 Trinity Petroleum Management, LLC General --
2024-11-21 Kellerhals Ferguson Kroblin PLLC General --
2024-11-21 Silverback Exploration General --
2024-11-20 Amherstburg Family Health General --
2024-11-10 Immuno Laboratories, Inc General --
2024-11-09 ATSG, Inc General --
2024-11-09 Mizuno General --
2024-11-09 Palmisano & Goodman, P.A. General --
2024-11-09 Palmisano and Goodman, P.A. General --
2024-11-08 Healthcare Management Systems General --
2024-11-05 Falco Sult General --
2024-11-05 Burch, APC General --
2024-11-05 L and B Transport, L.L.C. General --
2024-11-03 Russell Law Firm, LLC General --
2024-11-03 L & B Transport, L.L.C. General --
2024-11-02 B Transport, L.L.C. General --
2024-10-29 CLAS Information Services General --
2024-10-26 Premier Work Support General --
2024-10-24 McElroy, Quirk and Burch, APC General --
2024-10-24 McElroy, Quirk & Burch, APC General --
2024-10-23 Gluckstein Personal Injury Lawyers General --
2024-10-23 The Povman Law Firm General --
2024-10-16 Corporate Job Bank General --
2024-10-16 Lein Law Offices General --
2024-10-15 Boston Children's Health Physicians General --
2024-10-08 Pearl Cohen General --
2024-09-24 First Choice Sales & Marketing Group General --
2024-09-20 River Region Cardiology Associates General --
2024-09-19 Hunter Dickinson Inc. General --
2024-09-17 Sherr Puttmann Akins Lamb PC General --
2024-09-13 Law Offices of Michael J Gurfinkel, Inc General --
2024-09-13 KlockMetal General --
2024-09-13 Benson Kearley IFG - Insurance Brokers and Financial Advisors General --
2024-09-11 Ladov Law Firm General --
2024-09-10 HDI General --
2024-09-09 Anniversary Holding General --
2024-09-09 Battle Lumber Co. General --
2024-09-09 Smart Source, Inc. General --

Showing 100 most recent disclosures of 600 total records. Use the Live Feed or API for complete records.