TF-MAL-apk.bianlian
📛 Threat Title
Malware family: BianLian
Description
ThreatFox malware family `apk.bianlian`. Printable name: BianLian. Aliases: Hydra.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
apk.bianlian
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/apk.bianlian
IOC database
- Type
- domain
- Value
apk.bianlian- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-apk.bianlian
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/apk.bianlian
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:blogs.juniper.net
One method is to use the malware configuration search query in VirusTotal (VT) for the "topcorner" family . Figure 11: Virustotal (VT) search query for finding BianLian's Go backdoor. The latest versions of the backdoor, observed in 2024, show a slight modification in their logging function compared to the 2023 version.
-
web:dailysecurityreview.com
US and Australian cybersecurity agencies have issued an updated advisory on the BianLian ransomware group, detailing new tactics, techniques, and indicators of compromise (IoCs) following recent attacks on critical infrastructure and private enterprises. The group's shift to exfiltration-based extortion is highlighted.
-
web:www.attackiq.com
AttackIQ updates attack graph based on CISA Advisory AA23-136A, detailing BianLian ransomware IOCs and TTPs from FBI, CISA, and ACSC.
-
web:www.bleepingcomputer.com
BianLian attack tactics BianLian initially employed a double-extortion model, encrypting systems after stealing private data from victim networks, and then threatening to publish the files.
-
web:www.byteforensic.com
BianLian ransomware-specific IOCs include: Proactive monitoring, regular updates, and adherence to security best practices can enhance early detection and mitigation efforts against the BianLian ransomware threat.
-
web:www.cisa.gov
In Australia, ASD'S ACSC has observed BianLian group predominately targeting private enterprises, including one critical infrastructure organization. BianLian group originally employed a double-extortion model in which they exfiltrated financial, client, business, technical, and personal files for leverage and encrypted victims' systems.
-
web:www.hipaajournal.com
The BianLian group is a ransomware actor that develops and uses ransomware in its attacks, typically engaging in double extortion tactics, where sensitive private data is exfiltrated from victims' networks before files are encrypted.
-
web:www.imda.gov.sg
BianLian is a ransomware developer, deployer, and data extortion cybercriminal group. Originally, their operations were the typical double-extortion model of encrypting files and threatening to leak data.
-
web:www.picussecurity.com
Explore BianLian's shift to data extortion, advanced TTPs like LSASS dumping & RDP exploits, and major incidents like BCHP breach. Mitigation insights included.
-
web:www.sentinelone.com
How Does BianLian Ransomware Work? The group is quick to adopt new tactics and pivot to new lures to ensure successful distribution of their malware . Current BianLian ransomware payloads are written in Go. Initial access is achieved through exploitation of vulnerabilities on exposed systems and services.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.