Skip to main content
Ransomware Group

BianLian

BianLian ransomware operations began in late 2021. The group practices multi-pronged extortion, demanding payment for a decryptor, as well as the non-release of stolen data. The ransomware group hosts a public, TOR-based, blog to post victim identities and stolen data. Somewhat unique to BianLian at the time of their launch was their inclusion of an I2P mirror for their blog.

Known victims552

Threat level

CRITICAL

Get an alert if one of your domains is named on a ransomware leak site.

Monitor your domainsFree account · up to 5 monitored targets

Tactics, Techniques & Procedures (TTPs)

CredentialTheft

  • RDP Recognizer

DiscoveryEnum

  • Advanced IP Scanner
  • Advanced Port Scanner
  • PingCastle
  • SharpShares
  • SoftPerfect NetScan
  • +1 more

Exfiltration

  • MEGA
  • RClone

LOLBAS

  • PsExec

Offsec

  • Impacket

RMM-Tools

  • AmmyyAdmin
  • AnyDesk
  • Atera
  • ScreenConnect
  • Splashtop
  • +1 more

Indicators of Compromise (IOCs)

IP addresses

191
  • 104.238.35.179
  • 151.236.16.242
  • 85.235.151.5
  • 5.255.106.12
  • 23.227.198.237
  • 5.255.106.12
  • 98.82.12.229
  • 172.96.137.32
  • 64.52.80.103
  • 104.200.73.216
  • 104.238.57.233
  • 51.250.0.16
  • 44.201.115.56
  • 69.46.15.169
  • 69.46.15.169
  • +176 more

Get the complete IOC feed

The full IOC database by API, ready for your SIEM or SOAR.

Create free account

No credit card required · Free API key

Known infrastructure

The following Tor hidden services have been associated with this group:

  • BianLian | Home
  • BianLian | Home
  • bianliaoxoeriowgqohcly4a6sbkpc3se2yvxgidxomxlpuhx5ehrpad.onion

These sites are malicious. Open them only from an isolated environment.

0

Check if you’re affected

Look up your domain to see whether it appears on BianLian’s victim list.

Try it nowFree⌘K
Try

risk score · threat categories · sources · age · confidence — in one request

Other active ransomware groups

LockBitALPHV BlackcatCL0PPlayAkiraMedusaRhysida