FBI says BianLian Based in Russia, Moving from Ransomware Attacks to Extortion

Category	Details
Threat Actors	BianLian Ransomware group, likely based in Russia with Russian affiliates.
Campaign Overview	Initially encrypted files for ransom; now exclusively uses exfiltration-based extortion since January 2024. Targets healthcare, charities, and public-facing apps.
Target Regions	Primarily U.S., Canada, and global entities, including healthcare organizations like Boston Children’s Health Physicians and Amherstburg Family Health Team.
Methodology	Exploited vulnerabilities in public-facing applications (Windows/ESXi); focused on exfiltrating data for extortion. Uses social engineering for added pressure.
Product Targeted	Windows and ESXi systems, healthcare providers, charities, and critical infrastructure organizations.
Malware Reference	Previous ransomware encryptor (.bianlian extension); newer campaigns rely on data theft and extortion.
Tools Used	- Custom encryptor (legacy campaigns). - ProxyShell Vulnerabilities (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207). - CVE-2022-37969. - Tox chat system.
Vulnerabilities Exploited	ProxyShell Vulnerabilities (Windows and ESXi) and CVE-2022-37969 (affecting Windows 10 and 11).
TTPs	- Initial Access (T1190): Exploiting known vulnerabilities. - Credential Access (T1110): Creating admin accounts. - Impact (T1485): Threat of data leaks.
Attribution	Likely based in Russia; uses foreign-language names to obscure true origins.
Recommendations	Patch vulnerabilities promptly, segment networks, train employees on phishing/social engineering threats, and monitor systems for unauthorized admin accounts.
Source	The Record

Read full article: https://therecord.media/fbi-says-bianlian-based-in-russia-switching-tactics

Disclaimer: The above summary has been generated by an AI language model.