Threat Assessment: Bian Lian
Summary: Unit 42 tracked BianLian as a top-10 most active extortion group based on leak site data, targeting healthcare and manufacturing organizations mainly in the US and Europe, and responding to several BianLian incidents since September 2022. After Avast released a decryptor in early 2023, the group largely stopped encrypting and shifted to stealing data and threatening publication, while sharing a custom .NET tool and the same Advanced Port Scanner hash with the Makop ransomware group.
What you should know: In January 2023 BianLian claimed to have exfiltrated 1.7 TB of data, including patient and employee personal data, from a California-based hospital - and with encryption no longer part of the play, a working decryptor buys you nothing once the data is already out.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Ransomware
- Related
- Ransomware Defense Using the Wazuh Open Source Platform Cyber Risks ·