« Todas las amenazas

Bianlian

BianLian ransomware first appeared in June 2022 as a Go-based crypto-locker but pivoted in January 2023 to a pure data-extortion model after security firms released free decryptors for early versions. In its initial phase, it used AES-256 + RSA-2048 hybrid encryption, appending the .bianlian extension to files and dropping ransom notes with Tor links. The group targets a broad set of industries—healthcare, education, government, critical manufacturing, and professional services—with confirmed victims in the U.S., U.K., Australia, and Canada. Initial access is often obtained via compromised RDP credentials, exploitation of vulnerabilities in internet-facing systems, or use of stolen VPN credentials from infostealers. Post-compromise, BianLian conducts network reconnaissance, credential harvesting, and exfiltration of sensitive files before issuing extortion threats on its leak site. The group has claimed responsibility for dozens of breaches, with ransom demands often in the $100k–$2 million USD range.

Las reivindicaciones las publican los propios grupos criminales y no están verificadas hasta que la organización o la prensa las confirman. Los nombres de personas físicas (autónomos, profesionales individuales) se anonimizan conforme al RGPD. Nunca enlazamos a sitios de filtración ni a datos robados. Para solicitar la retirada o anonimización de una entrada, contacte con el administrador del sitio.

Fuentes: RansomLook (CC BY 4.0), MITRE ATT&CK®, MISP Galaxy, Google News.