BianLian showed that a ransomware group does not need to encrypt anything to extort a victim: stealing the data and threatening to publish it is enough. The FBI, CISA and the Australian Cyber Security Centre (ACSC) described in the joint #StopRansomware advisory AA23-136A how the group moved from double extortion to mainly exfiltration-based extortion around January 2023. Because no files are encrypted, victims can miss the intrusion until the extortion email arrives. This profile covers who the group is, what it targets, the techniques the advisory describes mapped to ATT&CK, how it relies on stolen RDP credentials and local admin accounts, and what defenders should monitor. It is written for SOC analysts, incident responders and identity teams. For the extortion model in general see the Data Extortion Without Encryption Guide.
Key takeaways
- Extortion without encryption: the FBI observed a shift to primarily exfiltration-based extortion around January 2023, and the ACSC observed the group move to exfiltration only.
- Valid RDP credentials are the front door: the advisory says BianLian gains access with valid RDP credentials, likely bought from initial access brokers, or obtained through phishing.
- Identity abuse drives the whole intrusion: the group creates or activates local administrator accounts, dumps LSASS and ntds.dit, and moves with PsExec and RDP using valid accounts.
- Pressure goes beyond the leak site: threats to send data to clients, partners, competitors and news agencies, ransom notes printed on network printers and threatening calls to employees.
- Detection must focus on exfiltration: with no encryption event, Rclone, FTP and Mega transfers and remote access tool installs are the signals that matter.
Who they are (names and aliases)
| Attribute | Detail (per AA23-136A unless stated) |
|---|---|
| Name | BianLian, described as a ransomware developer, deployer and data extortion group |
| Active since | Targeting US critical infrastructure sectors since June 2022 |
| Model | Double extortion until around January 2023, then primarily (FBI) or exclusively (ACSC) exfiltration-based extortion |
| Contact method | Ransom note with a fixed Tox ID and an email address; each victim gets a unique identifier and unique cryptocurrency wallets |
| Leak site | Tor site used to threaten publication |
| ATT&CK | No MITRE ATT&CK group entry at the time of writing; techniques below are mapped from the advisory |
The advisory does not state where the actors are based, and this page does not speculate. ENISA's 2025 threat landscape lists BianLian among the ransomware operations observed against EU organisations.
Targeting and motivation
BianLian is financially motivated. In the United States the FBI saw it target critical infrastructure sectors. In Australia the ACSC saw mainly private enterprises, including one critical infrastructure organisation, plus professional services and property development. The theft-only model suits organisations that hold sensitive client data, such as law firms, healthcare providers, manufacturers with intellectual property and professional services firms, because the leak threat has value even when backups are perfect.
| Encryption-based ransomware | BianLian's exfiltration-based extortion |
|---|---|
| Impact is loud: systems stop and users notice | Impact is quiet: business continues until the demand arrives |
| Backups reduce leverage | Backups do not help; the leverage is disclosure |
| Detection often at encryption | Detection must happen at access, staging or exfiltration |
| Response centres on recovery | Response centres on scoping stolen data, notification and legal advice |
Tactics and techniques (MITRE ATT&CK)
Mapped by NHI Mgmt Group from the behaviour described in AA23-136A to ATT&CK v20 technique IDs.
| Tactic | Technique | Behaviour described in the advisory |
|---|---|---|
| Initial access | T1078 Valid Accounts, T1566 Phishing | Valid RDP credentials likely from initial access brokers; phishing for user credentials |
| Persistence | T1136.001 Local Account, T1098 Account Manipulation | Creating or activating local administrator accounts and changing their passwords |
| Command and control | T1219 Remote Access Tools | Custom Go backdoor built per victim; TeamViewer, Atera Agent, SplashTop, AnyDesk |
| Execution | T1059.001 PowerShell, T1059.003 Windows Command Shell, T1569.002 Service Execution | PowerShell and cmd; PsExec |
| Defence impairment | T1685 Disable or Modify Tools, T1112 Modify Registry, T1686 Disable or Modify System Firewall | Disabling Defender and AMSI; registry change to disable Sophos tamper protection; firewall rules to allow inbound RDP |
| Discovery | T1046 Network Service Discovery, T1135 Network Share Discovery, T1087.002 Domain Account, T1482 Domain Trust Discovery | Advanced Port Scanner, SoftPerfect Network Scanner, SharpShares, PingCastle, native commands |
| Credential access | T1003.001 LSASS Memory, T1003.003 NTDS, T1552.001 Credentials In Files | LSASS dumping, ntds.dit access, Impacket secretsdump.py, searching files for credentials |
| Lateral movement | T1021.001 Remote Desktop Protocol | RDP and PsExec with valid accounts |
| Collection | T1083 File and Directory Discovery, T1115 Clipboard Data | PowerShell scripts to find sensitive files; a tool that reads clipboard data |
| Exfiltration | T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol, T1567.002 Exfiltration to Cloud Storage | FTP, Rclone and Mega; Rclone placed in folders such as programdata\vmware and music folders |
| Impact (before 2023) | T1486 Data Encrypted for Impact | encryptor.exe and the .bianlian extension |
How they abuse identities and credentials
Almost every stage of a BianLian intrusion as described is an identity event. That makes identity telemetry the best place to catch it.
- Bought RDP credentials: internet-exposed RDP with a password is enough. Remove direct RDP exposure, put remote access behind a VPN or gateway with phishing-resistant MFA, and enforce lockout. See the Remote Desktop (RDP) Security Guide.
- Local administrator accounts: creating or re-enabling a local admin account gives persistence that survives domain password resets. Use unique, rotated local admin passwords (for example Windows LAPS) and alert on account creation. Microsoft documents Event 4720 (a user account was created) under the Audit User Account Management subcategory.
- Domain credential theft: LSASS and ntds.dit dumping hand over domain hashes. The advisory recommends protecting domain admin accounts, enabling Credential Guard and using time-based privileged access. See the Privileged Identity Management (PIM) Guide.
- Plaintext credentials in scripts and files: the group searches for them, and the advisory says to avoid them. Move secrets into a vault and scan file shares for stored passwords. See the Secrets Management Guide.
- Remote access tool accounts: TeamViewer, AnyDesk and similar tools create their own identities outside your directory. Allowlist approved tools and log their execution.
Notable incidents
The advisory does not name individual victims, and this page does not repeat unverified leak site claims. What the public record supports:
| Period | Activity | Source |
|---|---|---|
| June 2022 onwards | Attacks on US critical infrastructure sectors and Australian private enterprises | AA23-136A |
| Around January 2023 | Shift from double extortion to primarily or exclusively exfiltration-based extortion | AA23-136A |
| March 2023 | Indicators of compromise in the advisory current as of this date | AA23-136A |
| July 2024 to June 2025 | BianLian among ransomware operations named in the EU dataset | ENISA Threat Landscape 2025 |
If your organisation appears on a leak site, treat the listing as a claim to verify, not a fact. See the Ransomware Data Leak Site Listing Playbook and the Ransomware Leak Sites and Victim Shaming Guide.
Detection and defence
What to monitor
| Signal | Where to see it | Why it matters |
|---|---|---|
| New or re-enabled local admin account | Windows Event 4720 and group membership changes | Persistence step described in the advisory |
| Successful RDP sign-in from the internet or an unusual source | Windows logon events with logon type 10, VPN and gateway logs | Initial access with bought credentials |
| Defender or AMSI disabled, tamper protection changed | Defender and EDR health events, registry auditing | Defence impairment before staging |
| Rclone, FTP clients or Mega traffic from servers | Process creation logs (Event 4688 with command line), proxy and firewall logs | Exfiltration, the moment of harm |
| Executables in unusual folders such as programdata\vmware or user music folders | EDR file events | The advisory's named staging locations |
| Unapproved remote access tool installs | Software inventory, application control logs | Command and control and persistence |
Phased defence plan
- Week 1, close RDP: find any RDP reachable from the internet and remove it. Require phishing-resistant MFA on the VPN or gateway that replaces it, and enable account lockout.
- Weeks 2 to 4, control tools: audit remote access tools, block unapproved ones with application allowlisting in audit mode first, then enforce. Keep an exception process for urgent supplier access as the rollback path.
- Month 2, protect credentials: deploy unique local admin passwords, enable Credential Guard, restrict PowerShell to the users who need it and enable enhanced PowerShell logging with at least 180 days of retention, as the advisory recommends.
- Month 3, watch the exit: limit server egress to known destinations, alert on cloud sync tools and large outbound transfers, and run a test exfiltration with your SOC to confirm alerts fire.
- Always: patch exploited internet-facing flaws within 24 to 48 hours, segment networks and keep offline, encrypted, immutable backups for the cases where encryption still happens.
Decision guidance
Smaller organisations should start with the first two steps; removing exposed RDP and unapproved remote tools takes away the access route and the persistence the advisory describes. Larger organisations with a SOC should invest in egress monitoring and identity threat detection, because theft-only extortion leaves no encryption event to trigger a response. Organisations that hold third-party data, such as law firms and outsourcers, should also plan for notifying clients, since BianLian threatens to contact them directly.
Metrics
- Number of internet-exposed RDP endpoints (target: zero).
- Percentage of endpoints with unique, rotated local admin passwords.
- Unapproved remote access tools detected per month.
- Mean time to detect a simulated exfiltration with a cloud sync tool.
- Percentage of remote access accounts on phishing-resistant MFA.
Framework mapping
| Control objective | NIST SP 800-53 Rev. 5 |
|---|---|
| Remote access and MFA | AC-17 Remote Access, IA-2 Identification and Authentication |
| Least privilege and least functionality | AC-6 Least Privilege, CM-7 Least Functionality |
| Logging and monitoring | AU-2 Event Logging, SI-4 System Monitoring |
| Backups | CP-9 System Backup |
Responding to a theft-only demand
- Verify the claim: ask for a file listing or samples and compare them with your own data. Check whether the samples could have come from an older breach or a supplier.
- Find the access route: review RDP and VPN sign-ins, new local accounts and remote access tool installs for the weeks before the demand. The intrusion may be weeks old.
- Scope the exfiltration: use proxy, firewall and EDR records of Rclone, FTP and Mega activity to estimate what left and when. See the Data Exfiltration Playbook.
- Evict and reset: remove backdoors and unapproved tools, disable created accounts, reset domain and local admin credentials and rotate service account secrets, in that order.
- Decide with counsel: notification duties, client communications and any payment decision need legal advice. The advisory says paying is not recommended because it does not guarantee the data will be deleted or recovered. See the Ransomware Negotiation Guide.
- Prepare staff: warn employees that they may receive threatening calls, and give them a script and a reporting route.
Practitioner checklist
- Remove internet-exposed RDP and require phishing-resistant MFA on remote access.
- Alert on local account creation (Event 4720) and admin group changes.
- Deploy unique local admin passwords and enable Credential Guard.
- Allowlist approved remote access tools and log their execution.
- Restrict PowerShell and keep enhanced PowerShell logs for at least 180 days.
- Remove plaintext credentials from scripts and file shares.
- Monitor server egress for Rclone, FTP and Mega and test the alert.
- Prepare a theft-only extortion playbook covering data scoping, client notification and legal advice.
Standards and references
- FBI, CISA and ACSC: #StopRansomware: BianLian Ransomware Group (AA23-136A)
- CISA: #StopRansomware Guide
- Microsoft Learn: 4720(S) A user account was created
- MITRE ATT&CK: Exfiltration to Cloud Storage
- MITRE ATT&CK: Create Account: Local Account
- ENISA: Threat Landscape 2025
- NIST: SP 800-53 Rev. 5
Related NHI Mgmt Group resources: Data Extortion Without Encryption Guide · Remote Desktop (RDP) Security Guide · Data Exfiltration Guide · Ransomware Groups Guide