Ransomware Group intelligence

Bianlian

Inactive

Track Bianlian with 558 published victims and 3 known leak locations in a single intelligence view.

BREACH HOUSE ALERTS

Want an alert every time a new ransomware post is published?

Choose the feeds and the countries you care about — we email you when they move.

Victims 558 Known published victims in this dataset

First discovered 2022-07-14 Earliest victim discovery date

Last discovered 2025-03-31 Latest victim discovery date

Inactive since 519 days Days since the latest known victim

Top country United States 167 victims

Known locations 3 Leak or negotiation infrastructure tracked

Bianlian is tracked by Breach House as a ransomware group with 558 published victims.

United States is currently the most targeted country in this dataset.

3 known leak locations are currently associated with this group.

Top Countries

Distribution

Label	Type	Availability	Links
Leak location 2	Onion service	Down checked 25m ago	`bianlivemqbawcco4cx4a672k2fip3guyxudzurfqvdszafam3ofqgqd.onion`
Leak location 3	Onion service	Down checked 25m ago	`bianliaoxoeriowgqohcly4a6sbkpc3se2yvxgidxomxlpuhx5ehrpad.onion`
Leak location 1	Onion service	Down checked 34m ago	`bianlianlbc5an4kgnay3opdemgcryg2kpfcbgczopmm3dnbz3uaunad.onion`

Communication / Marketing 88
Healthcare / Pharma 75
Services 69
Finance / Legal / Insurance 66
Not identified 59
Construction / Real Estate 44
Manufacturing / Engineering 33
IT 26
Transportation / Travel / Logistics 22
Education 20
Energy 11
Hospitality / Food & Beverage / Tourism 9
Public Sector 8
Retail / E-commerce 8
Telecommunications 5
Agriculture / Food 4
NGOs / Associations 2

Typical Attacks (10)

▼

MITRE ATT&CK does not currently catalogue Bianlian, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.

T1059.001 PowerShell Execution

What they do: bianlian uses PowerShell scripts to execute malicious commands and deploy ransomware payloads across compromised systems.

What that means: Adversaries may abuse PowerShell commands and scripts for execution.
T1547.001 Registry Run Keys / Startup Folder PersistencePrivilege Escalation

What they do: bianlian modifies registry run keys to ensure ransomware reactivation after system reboots for persistence.

What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
T1685 Disable or Modify Tools Defense Impairment

What they do: bianlian disables antivirus tools and security software to evade detection during initial compromise and execution.

What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
T1070.004 File Deletion Stealth

What they do: bianlian deletes Volume Shadow Copies and backup directories via command-line tools to prevent data recovery.

What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
T1018 Remote System Discovery Discovery

What they do: bianlian uses remote system discovery to map victim infrastructure and identify high-value targets for encryption.

What that means: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.
T1049 System Network Connections Discovery Discovery

What they do: bianlian queries system network connections to identify active services and communication paths for exfiltration or command channels.

What that means: Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
T1135 Network Share Discovery Discovery

What they do: bianlian performs network share discovery to identify victim file shares and target data for encryption.

What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
T1021.002 SMB/Windows Admin Shares Lateral Movement

What they do: bianlian exploits SMB/Windows Admin Shares to move laterally within victim networks to additional hosts.

What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
T1567.002 Exfiltration to Cloud Storage Exfiltration

What they do: bianlian exfiltrates stolen data using encrypted channels to enable double extortion against victims.

What that means: Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel.
T1486 Data Encrypted for Impact Impact

What they do: bianlian encrypts victim files using custom ransomware binaries to maximize impact and pressure for payment.

What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.

Tools Observed (17)

▼

Software Bianlian has been seen using, grouped by what it is used for. Legitimate administration tools appear here because these actors routinely abuse them — presence in this list is not itself malicious.

Credential theft

RDP Recognizer

Discovery & enumeration

Advanced IP Scanner Advanced Port Scanner PingCastle SharpShares SoftPerfect NetScan WKTools

Exfiltration

MEGA RClone

LOLBAS (living-off-the-land binaries)

PsExec

Offensive security tooling

Impacket

Remote monitoring & management

AnyDesk AmmyyAdmin Atera ScreenConnect Splashtop TeamViewer

Tool data from Ransomware Tool Matrix by BushidoUK, licensed CC BY 4.0. Grouped by purpose and matched to this group by Breach House.

Ransom Notes (1)

▼

The note this group leaves on a compromised machine. Click a filename to read it.

Look at this instruction.txt txt · 1053 chars

Your network systems were attacked and encrypted. Contact us in order to restore your data. Don't make any changes in your file structure: touch no files, don't try to recover by yourself, that may lead to it's complete loss.

To contact us you have to download "tox" messenger: https://qtox.github.io/

Add user with the following ID to get your instructions:
A4B3B0845DA242A64BF17E0DB4278EDF85855739667D3E2AE8B89D5439015F07E81D12D767FC

Alternative way: [email protected]

Your ID: [snip]

You should know that we have been downloading data from your network for a significant time before the attack: financial, client, business, post, technical and personal files.
In 10 days - it will be posted at our site http://bianlianlbc5an4kgnay3opdemgcryg2kpfcbgczopmm3dnbz3uaunad.onion / http://bianlivemqbawcco4cx4a672k2fip3guyxudzurfqvdszafam3ofqgqd.onion with links send to your clients, partners, competitors and news agencies, that will lead to a negative impact on your company: potential financial, business and reputational loses.
   ---!!!---

View on RansomLook

Ransom-note text from RansomLook, licensed CC BY 4.0.

Victims (558)

Search, filter and paginate the victim timeline for Bianlian. Showing 401–500 of 558.

Type	Target	Discovered	Country	Business Category	Intel Link
Ransomware	NewYorker id6089 View details	2023-04-11		Other
No additional victim description available. ID 6089
Ransomware	Waynesboro id6088 View details	2023-04-11		Other
No additional victim description available. ID 6088
Ransomware	Arizona Reproductive Medicine Specialists id6087 View details	2023-04-11		Healthcare / Pharma
No additional victim description available. ID 6087
Ransomware	G&G ectronics id6086 View details	2023-04-11		Other
No additional victim description available. ID 6086
Ransomware	Surtronics id6085 View details	2023-04-11		Other
No additional victim description available. ID 6085
Ransomware	Smith Industries id6084 View details	2023-04-11		Other
No additional victim description available. ID 6084
Ransomware	Skyway Endodontics id6083 View details	2023-04-11		Other
No additional victim description available. ID 6083
Ransomware	Flensburger Schiffbau Gesellschaft mbH & Co. and Nobiskrug Yachts GmbH id6082 View details	2023-04-11	Germany	Other
No additional victim description available. ID 6082
Ransomware	G** and ********* id6081 View details	2023-04-11		Other
No additional victim description available. ID 6081
Ransomware	Harvard Energy id6077 View details	2023-04-10	Canada	Energy
Harvard Energy is a petroleum and natural gas exploration and production partnership with offices in Calgary, Alberta and interests throughout Western Canada. ID 6077
Ransomware	Meriton id6038 View details	2023-04-06	Australia	Construction / Real Estate
Meriton is an Australian property developer and construction company founded by Harry Triguboff AO, its managing director, in 1963. Meriton sells apartments and also operates serviced apartments accommodation under its Meriton Suites brand in Sydney, Brisbane and the Gold Coast. For 60 years, Meriton has grown to become Australia’s largest and most successful residential developer. ID 6038
Ransomware	Quad-County Ready Mix id6037 View details	2023-04-06		Public Sector
Concrete manufacturer, Fourth Generation Family-Owned Business. QCRM has always welcomed the chance at new challenges and if given the opportunity, QCRM would supply any project with the highest quality and service standards in the industry, while maintaining a strong dedication to safety. ID 6037
Ransomware	i*** *** id6036 View details	2023-04-06		Services
A supplier and manufacturer, this company says that it is a worldwide leading specialist in the Independent Aftermarket. They offer repair solutions for all common vehicle types in the car and commercial vehicle sector. ID 6036
Ransomware	E* **** id6035 View details	2023-04-06		Other
A company that operates in the Human Resources industry. ID 6035
Ransomware	F****** *****-******** id5960 View details	2023-03-29		Construction / Real Estate
A shipbuilding company, located in Europe. Range of company projects includes naval ships and luxury yachts. ID 5960
Ransomware	G** & ********* id5959 View details	2023-03-29		Manufacturing / Engineering
Manufacturer of pipe plugs, reducer bushings, and special screw machine parts, located in USA. ID 5959
Ransomware	X* * id5958 View details	2023-03-29		Transportation / Travel / Logistics
Refrigerated trucking company located in USA. ID 5958
Ransomware	A*** id5957 View details	2023-03-29		Transportation / Travel / Logistics
A company that operates in the Airlines/Aviation industry, located in USA. ID 5957
Ransomware	F* *** ********** id5956 View details	2023-03-29		Transportation / Travel / Logistics
A full service courier, delivery, transportation, and logistics company, located in USA. ID 5956
Ransomware	T* **** ****** id5955 View details	2023-03-29		Communication / Marketing
Wood products inspection and testing company. ID 5955
Ransomware	Rimex id5942 View details	2023-03-28	Canada	Manufacturing / Engineering
RIMEX, founded in 1975 and headquartered in British Columbia, Canada, is a company that manufactures wheels and rims for mining and industrial applications. ID 5942
Ransomware	Victoria Park id5941 View details	2023-03-28	Sweden	Construction / Real Estate
Victoria Park AB (publ) is a listed property company, which, through long-term management and social responsibility for more attractive living, creates value in an expanding property portfolio in growth districts in Sweden. ID 5941
Ransomware	C** **** id5940 View details	2023-03-28	United States	Manufacturing / Engineering
Company is part of the Automotive Service & Collision Repair industry, and located in United States. ID 5940
Ransomware	***** A***** ******* ***** id5714 View details	2023-03-16		Communication / Marketing
Provider of automotive port processing services catering to domestic and foreign automotive OEMs. The company provides import, export, domestic re-marshaling and rail processing, automotive rail loading and unloading, alongside vessel marine terminal services and other related services. ID 5714
Ransomware	S***** * id5693 View details	2023-03-13		Services
European organization that delivers financial consulting services. ID 5693
Ransomware	Mason Manufacturing id5692 View details	2023-03-13		Manufacturing / Engineering	—
No additional victim description available. ID 5692
Ransomware	Data Pro Accounting Software, Inc id5691 View details	2023-03-13		Finance / Legal / Insurance	—
No additional victim description available. ID 5691
Ransomware	*P *** L** * id5580** View details	2023-03-05	Indonesia	—
Indonesian company that operates in agricultural industry. ID 5580
Ransomware	*P *** L** * id32040** View details	2023-03-05	Indonesia	—
Indonesian company that operates in agricultural industry. ID 32040
Ransomware	R id5579 View details	2023-03-05	Canada	—
A manufacturer of wheels and rims from Canada. ID 5579
Ransomware	R id32041 View details	2023-03-05	Canada	—
A manufacturer of wheels and rims from Canada. ID 32041
Ransomware	V*** id5578 View details	2023-03-05		IT
European real estate company. ID 5578
Ransomware	V*** id5585 View details	2023-03-05		IT
European real estate company. ID 5585
Ransomware	A* ***** ****** id5577 View details	2023-03-05		Other
Furniture company located in USA. ID 5577
Ransomware	S* ******* id5576 View details	2023-03-05		Healthcare / Pharma
Dental clinic located in USA. ID 5576
Ransomware	S******* ****** id5575 View details	2023-03-05		Education
USA educational organization. ID 5575
Ransomware	T**** * ****** id5574 View details	2023-03-05		Education
USA educational organization. ID 5574
Ransomware	ACCSC id5569 View details	2023-03-03		Education	—
Accrediting Commission Of Career Schools Colleges. ACCSC’s scope of recognition with the U.S. Department of Education includes the accreditation of postsecondary, non-degree-granting institutions and degree-granting institutions that are predominantly organized to educate students for occupational, trade and technical careers. ID 5569
Ransomware	Zerbe Retirement Community id5568 View details	2023-03-03		Healthcare / Pharma	—
Zerbe Retirement Community is part of the Hospitals & Physicians Clinics industry. ID 5568
Ransomware	PLP Architecture id5567 View details	2023-03-03		Construction / Real Estate	—
PLP Architecture is part of the Architecture, Engineering & Design industry. ID 5567
Ransomware	M M******** id5566 View details	2023-03-03		—	—
The Company custom fabrication of shell and tube heat exchangers, ASME pressure vessels, columns, and tanks for a variety of processing industries. ID 5566
Ransomware	M M******** id32044 View details	2023-03-03		—	—
The Company custom fabrication of shell and tube heat exchangers, ASME pressure vessels, columns, and tanks for a variety of processing industries. ID 32044
Ransomware	Parques Reunidos id5565 View details	2023-03-03	Spain	—	—
Parques Reunidos is an international entertainment operator based in Madrid, Spain. The group operates over 60 parks in about dozen countries. Parques Reunidos operates theme and amusement parks, zoos, water parks, family entertainment centers, and cable cars. ID 5565
Ransomware	Parques Reunidos id32045 View details	2023-03-03	Spain	—	—
Parques Reunidos is an international entertainment operator based in Madrid, Spain. The group operates over 60 parks in about dozen countries. Parques Reunidos operates theme and amusement parks, zoos, water parks, family entertainment centers, and cable cars. ID 32045
Ransomware	G&G Electronics id5524 View details	2023-02-26		Communication / Marketing	—
G&G Electronics is the store of home appliances and has a great selection of premium brands such as Sony, Bose, Panasonic, Denon, Marantz, Monster, GoPro, Sonos, EcoXGear and more. ID 5524
Ransomware	A ***** ***** & * id5523 View details	2023-02-26		Finance / Legal / Insurance	—
A firm serving San Antonio, TX in Insurance Defense, Workers Compensation Defense and Civil Trial Practice cases. ID 5523
Ransomware	D* id5522** View details	2023-02-26		Finance / Legal / Insurance	—
Company that developing a wide range of sophisticated accounting software and electronic commerce applications. ID 5522
Ransomware	NESG id5471 View details	2023-02-17		Healthcare / Pharma	—
Group of Osteopathic Physicians who provide surgical health care at its highest level of expertise. ID 5471
Ransomware	Fibertec id5470 View details	2023-02-17		Manufacturing / Engineering	—
Fibertec Environmental Services is a full-service environmental analytical laboratory, specializing in subsurface investigations, industrial hygiene, and natural gas analysis. ID 5470
Ransomware	Suburban Laboratories id5469 View details	2023-02-17		Communication / Marketing	—
Suburban Laboratories was founded in 1936. The original lab was located in Cicero, Illinois where it remained for over 30 years. In 1970 the lab was purchased by three professional engineers; Dr. Fred Gurnham, Robert Konvalinka and Earl Rosenberg. ID 5469
Ransomware	I* id5416 View details	2023-02-12		Healthcare / Pharma	—
Medical Testing & Clinical Laboratories. ID 5416
Ransomware	The Gucciardo Law Firm id5415 View details	2023-02-12		Finance / Legal / Insurance	—
We are relentlessly committed to our clients as if they were members of our own family. You can turn to us for guidance and honest answers. ID 5415
Ransomware	Danielski Farms Inc. id5414 View details	2023-02-12		Agriculture / Food	—
Danielski Farms Inc. strives to perform the highest quality and efficient harvest of our customers’ crops. Being farmers ourselves, we know the painstaking efforts required to see a crop through from planting to harvest. ID 5414
Ransomware	Advance2000 id5409 View details	2023-02-11		Communication / Marketing	—
Full-service managed IT service provider specializing in Private Cloud Computing. ID 5409
Ransomware	ANXA id5408 View details	2023-02-11		Communication / Marketing	—
The company provides wellness solutions for the 21st century and creates innovative well-being products that are also efficient and effective solutions. ID 5408
Ransomware	Thompson Safety id5407 View details	2023-02-11		IT	—
Thompson Safety is a company that operates in the Information Technology and Services industry. The company is headquartered in Houston, Texas. ID 5407
Ransomware	HAK Grazbachgasse id5406 View details	2023-02-11		Education	—
The commercial academy (HAK) is a higher vocational school with a business focus. The education lasts 5 years and ends with the maturity and diploma examination, which also replaces the entrepreneurial examination. ID 5406
Ransomware	Woodmeister Master Builders, Inc. id5375 View details	2023-02-06		Construction / Real Estate	—
Woodmeister provides residential construction, custom cabinetry and interiors, lifestyle management, green building, and design. ID 5375
Ransomware	r** ****** **** ********* id5374 View details	2023-02-06		Healthcare / Pharma	—
Reproductive Medicine Specialists offers IVF fertility treatment, egg donation, IUI & ICSI for male and female infertility. ID 5374
Ransomware	A* id5373** View details	2023-02-06		Communication / Marketing	—
The company provides wellness solutions for the 21st century and creates innovative well-being products that are also efficient and effective solutions. ID 5373
Ransomware	A***** id5372 View details	2023-02-06		Communication / Marketing	—
Full-service managed IT service provider specializing in Private Cloud Computing. ID 5372
Ransomware	N **** id5330 View details	2023-02-01		Other	—
An international textile trading company. The company has 1,000 branches located in 40 countries. ID 5330
Ransomware	******* **** * * id5296 View details	2023-01-26		Healthcare / Pharma	—
Group of Osteopathic Physicians who provide surgical health care at its highest level of expertise. ID 5296
Ransomware	******* id5295 View details	2023-01-26	Australia	Other	—
Demo data pack of a company located in Australia. ID 5295
Ransomware	HRL Technology Group id5276 View details	2023-01-21	Australia	IT	—
HRL Technology Group is a leading analytical laboratory, specialist engineering and innovation services company. ID 5276
Ransomware	N id5275 View details	2023-01-21		Communication / Marketing	—
Manufacturer of fire protection products ID 5275
Ransomware	A id5274 View details	2023-01-21		Retail / E-commerce	—
jewelry store ID 5274
Ransomware	St. Rose Hospital id5156 View details	2022-12-29		Healthcare / Pharma	—
St. Rose Hospital is an hospital located in Hayward, California. It is a designated cardiac arrest receiving center in the Alameda County emergency medical services system, and provides basic emergency medical services. ID 5156
Ransomware	MITCON Consultancy & Engineering Services id5155 View details	2022-12-29	India	Services	—
Established in 1982 in Pune, Mitcon is a renowned Indian Technical Consulting Organization (TCO) offering One Stop Solution for all your technical, marketing & financial business requirements. ID 5155
Ransomware	********* E*** id5154 View details	2022-12-29		Energy	—
Company that operates in the Oil & Energy industry. ID 5154
Ransomware	Myofficeplace Inc. id5091 View details	2022-12-23		Communication / Marketing	—
Managed, Dedicated enterprise-class Cloud hosting for businesses. Citrix Hosting, Virtual Servers. ID 5091
Ransomware	SEMITEC Corporation id5090 View details	2022-12-23	Viet Nam	Manufacturing / Engineering	—
Semitec Vietnam (SEV) is the 15th subsidiary of Semitec Corporation, headquartered in Japan. The company specializes in manufacturing electronics, sensors. ID 5090
Ransomware	***** id5089 View details	2022-12-23		Healthcare / Pharma	—
International provider of analytics, technology solutions and contract research services for the healthcare industry. ID 5089
Ransomware	Realstar Holdings Partnership id5088 View details	2022-12-23	Canada	Construction / Real Estate	—
Realstar is a company that operates in the Real Estate industry. It employs 251-500 people and has $50M-$100M of revenue. The company is headquartered in Toronto, Ontario, Canada. ID 5088
Ransomware	Berlina Tbk id4953 View details	2022-12-22		IT	—
Berlina Tbk provides one stop solution for plastic packaging with state-of-the-art technology and machinery, complete product design & development, Tube, Injection Moulding, Blow Moulding, Cap, Decoration and Mould making facilities. ID 4953
Ransomware	M* id4951 View details	2022-12-21		Manufacturing / Engineering	—
Consultancy and engineering services firm. ID 4951
Ransomware	M***l* id4950** View details	2022-12-21		Other	—
Hosting, quick book hosting, sql hosting, exchange hosting. ID 4950
Ransomware	S** Electronics" id4949 View details	2022-12-21	Japan	Manufacturing / Engineering	—
Corporation manufactures and sells electronic components in Japan and internationally ID 4949
Ransomware	Australian Real Estate Group Pty Ltd id4884 View details	2022-12-17	Australia	Construction / Real Estate	—
Australian Real Estate Group Pty Ltd is a company focused on all things real estate. ID 4884
Ransomware	Spa id4878 View details	2022-12-16		Other	—
No additional victim description available. ID 4878
Ransomware	Company, LLC id4877 View details	2022-12-16		Services	—
No additional victim description available. ID 4877
Ransomware	Rudman id4855 View details	2022-12-15		Other	—
No additional victim description available. ID 4855
Ransomware	Meisenkothen id4854 View details	2022-12-15		Other	—
No additional victim description available. ID 4854
Ransomware	Hci Systems Inc id4853 View details	2022-12-15	United States	Services	—
No additional victim description available. ID 4853
Ransomware	Eureka Casino Resort id4852 View details	2022-12-15		Hospitality / Food & Beverage / Tourism	—
No additional victim description available. ID 4852
Ransomware	Emilio Sanchez American School id4851 View details	2022-12-15		Education	—
No additional victim description available. ID 4851
Ransomware	Aria systems id4850 View details	2022-12-15		Services	—
No additional victim description available. ID 4850
Ransomware	CIMT College id4849 View details	2022-12-15		Education	—
No additional victim description available. ID 4849
Ransomware	ZXP Technologies id4848 View details	2022-12-15		IT	—
ZXP Technologies provides blending, packaging and world wide distribution of premium, mineral oil based and synthetic lubricants, fuel treatments, antifreeze, automotive care, agricultural chemical and bulk powder products. ID 4848
Ransomware	Modular Mining Systems id4836 View details	2022-12-12		Services	—
No additional victim description available. ID 4836
Ransomware	BRYCON Construction id4835 View details	2022-12-12		Construction / Real Estate	—
No additional victim description available. ID 4835
Ransomware	***a* law id4834 View details	2022-12-12		Finance / Legal / Insurance	—
No additional victim description available. ID 4834
Ransomware	Bonn Nutrients Pvt id4729 View details	2022-12-05		Other	—
No additional victim description available. ID 4729
Ransomware	Golden Coin Bake Shop and Restaurant id4728 View details	2022-12-05		Retail / E-commerce	—
No additional victim description available. ID 4728
Ransomware	Ability Commerce id4727 View details	2022-12-05		Retail / E-commerce	—
No additional victim description available. ID 4727
Ransomware	CROWN TECHNOLOGY Ltd id4726 View details	2022-12-05		IT	—
No additional victim description available. ID 4726
Ransomware	IM Group id4725 View details	2022-12-05		Services	—
No additional victim description available. ID 4725
Ransomware	u*** id4724 View details	2022-12-05		Other	—
No additional victim description available. ID 4724
Ransomware	**** ***** School id4723 View details	2022-12-05		Education	—
No additional victim description available. ID 4723
Ransomware	AV Solutions id4722 View details	2022-12-05		Services	—
No additional victim description available. ID 4722