BianLian Data Extortion Group – Updated Advisory

The Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) have released a joint Cybersecurity Advisory detailing the tactics, techniques, and procedures (TTPs) of the BianLian ransomware and data extortion group. This advisory, updated as of November 20, 2024, provides critical insights into the group's operations and offers recommendations to mitigate associated risks.

Executive Summary

BianLian is a cybercriminal group specializing in ransomware development, deployment, and data extortion. Active since June 2022, they have targeted multiple U.S. critical infrastructure sectors and Australian organizations, including professional services and property development. Initially employing a double-extortion model—encrypting systems and exfiltrating data—they shifted to primarily exfiltration-based extortion by January 2023 and exclusively to this method by January 2024. Their operations involve exploiting Remote Desktop Protocol (RDP) credentials, utilizing open-source tools for system discovery and credential harvesting, and exfiltrating data via protocols like FTP, Rclone, or Mega. The group threatens to release sensitive data if ransom demands are unmet.

Full Technical Analysis

Initial Access

• Credential-Based Access: BianLian primarily exploits stolen RDP credentials obtained through initial access brokers or via targeted phishing campaigns.
• Public-Facing Vulnerabilities: Exploits include known vulnerabilities in Windows and ESXi systems. Specifically, they likely leverage the ProxyShell vulnerability chain (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) to compromise Exchange servers.
• TTP Evolution: Adapted initial access vectors and delivery mechanisms align with observed trends in exploit targeting across critical infrastructure and enterprise systems.

Command and Control (C2)

• C2 Mechanisms: Utilizes persistent backdoors and open-source tools for maintaining access and executing commands.
• Reconnaissance: Performs thorough internal network discovery using utilities like PowerShell, WMI, and built-in administrative tools to map the environment and identify high-value systems.
• Credential Harvesting: Deploys tools such as Mimikatz to extract credentials from memory, enabling lateral movement and privilege escalation.

Lateral Movement and Privilege Escalation

• Toolset:
  • PowerShell for executing commands and file transfers.
  • Native Windows utilities, including tasklist, netstat, and ipconfig, for network and process enumeration.
• Custom and Open-Source Payloads: Leveraged for evasion and privilege escalation, often obfuscated to bypass detection mechanisms.

Data Exfiltration

• Exfiltration Mechanisms: Data is extracted using a mix of:
  • FTP for direct file transfers.
  • Rclone for synchronizing data with cloud storage.
  • Mega for encrypted data storage and retrieval.
• Data Prioritization: Focuses on sensitive corporate data, financial records, and intellectual property to maximize leverage in extortion campaigns.

Extortion Model

• Shift to Exfiltration-Based Extortion: By early 2024, BianLian fully abandoned encryption and focused exclusively on data exfiltration. This change reduces their operational footprint while enhancing their ability to monetize stolen data.
• Public Disclosure Threats: Leverages dark web and public leak sites to pressure victims into paying ransoms.

MITRE ATT&CK Tactics and Techniques