An infection with BianLian is characterised by your systems displaying a notice as shown here, with the specialist cybercrime group holding your infected systems and stolen data hostage until you pay a ransom. The ransom is typically demanded in cryptocurrency such as bitcoin.
If you discover a physical break-in at your offices, your first thought would be to call the police; touch nothing and let them search for clues to the perpetrator. Then, work out how to get your business operations back up and running.
A cyber-attack requires the same logic. Your environment is a CRIME SCENE. It's imperative for the environment to remain untouched so that a forensic investigation can be carried out.
This is not a job for your IT team or MSP. There are digital forensic specialists available 24/7 who can assist you, just like in a physical crime.
If your systems display a message like the above, they have been compromised by a BianLian attack.
Emerging in late 2021, the BianLian Ransomware group has targeted organisations in the US and Australia, showing a strong preference for critical infrastructure such as government entities, healthcare and education. The group, believed to have originated in China, takes its name from the ancient Chinese art that involves face-changing, which is telling of BianLian’s rapid adaptation and evolution methodology. BianLian currently ranks as one of the most effective ransomware groups in the world.
BianLian isn't currently using Ransomware-as-a-Service (RaaS), but it quickly adapts tactics to ensure successful malware distribution. They access victim systems with valid Remote Desktop Protocol (RDP) credentials, use open-source tools for discovery and credential harvesting, and exfiltrate data via FTP, Rclone, or Mega. The ransomware group maintains a public blog on the TOR network to publish information about victims and the data they have stolen. Initially, they employed a double-extortion model, encrypting victim systems after exfiltrating data. However, around January 2023, they shifted primarily to exfiltration-based extortion.
Exfiltration-based extortion is a tactic used by BianLian where they steal sensitive data from a victim's network and then threaten to release, sell, or publicly expose the data unless a ransom is paid.
This method increases the pressure on the victim to comply with the ransom demands, as the potential consequences of data exposure can include legal ramifications, reputational damage, and financial losses. This tactic is often used in combination with traditional ransomware attacks, where data is also encrypted to further compel the victim to pay the ransom.
BianLian first emerged in late 2021, and since then, the group has successfully attacked 521 known organisations.
Solace Cyber’s track record includes hundreds of successful response recoveries, providing Digital Forensic Incident Response services, 24x7x365.
“Cyber risks, such as IT outages, ransomware attacks or data breaches, rank as the most important risk globally (34% of responses) for the second year in succession – the first time this has occurred.”
Read more...
Solace Global was founded in 2010 as global experts in risk management and security, offering services such as Travel, Crisis, and Offshore Risk Management. With a 24/7 Security Operations Centre and an in-house intelligence team providing daily and weekly reports, Solace Global is accredited to ISO 27001, 14001, 45001, and 9001 standards.
Solace Cyber was established in 2021, specialising in Cyber breaches, particularly Digital Forensics and Incident Response, Ransomware, Risk Management, and Information Security, along with Managed Security Services. The leadership team collectively possess over 20 years of experience in the IT and security industry.
Solace Cyber is accredited to ISO 27001 and in 2022 gained the prestigious Cyber Incident Response (Level 2) accreditation with the National Cyber Security Centre in 2022. This accreditation represents the UK’s highest cyber security standards, providing top-tier incident response support and recovery.
s
%+
A forensic analysis needs to be meticulous and a clean restore and recovery requires a wealth of experience not normally available in an in-house team who must provide a broader range of IT support skills:
Solace Cyber was established precisely for this scenario. We have a well-defined process for handling cyber-attacks like BianLian, which involves a 6-step approach:
It includes a thorough digital forensic analysis from step 2 where the output becomes a central component of business recovery. This is because understanding the attack is of critical importance:
It is critical that the analysis of digital evidence is carried out to an agreed plan. This will have been designed to provide the best and earliest chance of discovering a root cause, which is essential to inform remediation/eradication and recovery as well as supporting a legal take-down case if this is applicable. A legal take-down means we can assist in the legal enforcement that stops the criminals from publishing the data, thus undermining the ransom notice.
Solace’s Digital Forensic and Incident Response teams maintain consistent communication throughout. Dedicated Incident Managers and technical engineering leads provide updates during the Cyber Incident Response journey, utilising risk registers and working within change management processes, all from triage through to post-incident, delivering successful business recovery.
Solace Cybers’ support continues beyond the recovery process. Once your business is back up and running, we work with you to transform your cyber security through a threat-informed approach utilising our Solace Global - Cyber 9 Step Process.
The BianLian ransomware entered your system in a few ways:
We recommend you adopt policies to:
After recovering from BianLian, Solace Cyber recommends that you update your business continuity plan to account for lessons learnt during this attack & recovery.
Most ransomware breaches cost approx £500K with smaller email data breaches in the realm of £50K. There is a dichotomy of preserving the environment for forensics or recovering it quickly for less business interruption. The cost increases the longer it takes to identify the breach and resolve it.
A Cyber Security insurance claim is complex and includes reasonable expenses to investigate and remediate an incident along with cover for legal, business interruption, criminal liability, employment liability and ransom policies. The insurance industry is liable to deliver the business recovery BUT Cyber insurance is viewed as volatile within the industry and many insurance policies are not being validated correctly.
Navigating through this requires experience, which is where Solace Cyber can help.
Criminal organisations like BianLian are paid by affiliates to launch cyber-attacks using their specific brand of malware that is known for its swift and efficient encryption capabilities. Even if the ransom is paid, the likelihood of having files decrypted and data restored is minimal, underscoring the necessity of employing a ransomware incident response team.
The NCSC have documented the deliberations for paying ransomware: https://www.ncsc.gov.uk/ransomware/home
Important Reminder: It is a criminal offense to pay money to people who are subject to financial sanctions. The list of who is subject to financial sanctions is constantly changing.
The latest iteration can be found here: https://www.gov.uk/government/publications/financial-sanctions-consolidated-list-of-targets
Almost certainly, yes.
It is possible that some of the data lost is classified as “Personal Data” to your customer. You have a legal obligation to protect that data but it may have been lost. You may also need to advise the Information Commissioner's Office (ICO) at https://ico.org.uk/.
Your insurer/legal council will advise you on what to do and how to proceed with this.
Solace has experience working with insurers and lawyers and can help in this relationship at this stressful time.
A ransomware attack poses the biggest threat to your business by:
If you have a business interruption, how do you know where you are in your supply chain for any one item and how do you carry on with your business? If it persists for a long time, how do you maintain your operation? And when your systems and data are restored, how do you backfill with any work you did and how do you operate going forward?
Ransomware is second only to receivership for debilitating a business.
The NCSC is the UK National Cyber Security Centre. They provide cyber security guidance and support, helping to make the UK the safest place to live and work online. They have defined a Cyber Incident Response procedure and they have approved and accredited suppliers to provide this service.
As a recognised Assured Service Provider by the National Cyber Security Centre (NCSC), Solace Cyber provide comprehensive cyber risk management services that are designed to Protect, Detect & Mitigate cyber security threats across the UK.
Action Fraud is the UK's national reporting centre for fraud and cybercrime. Whether you have been scammed, defrauded, or experienced cybercrime in England, Wales, or Northern Ireland, Action Fraud offers a central point of contact for information on fraud and financially motivated cybercrime.
If your systems are showing signs of a BianLian attack, REMAIN CALM.
YOU MUST NOT TOUCH THEM, RESTORE OR OVERWRITE THE DATA (explanation above).
Contact Solace Cyber on 01202 308818 or complete our form for a call back from one of our experts.
We will act promptly to reduce your business downtime.
Solace Cyber, part of Solace Global, helps companies across the UK recover from ransomware attacks and data breaches.
SOLACE GLOBAL CYBER LTD is registered in England & Wales no. 08830710
Solace Global
Twin Sails House,
W Quay Rd,
Poole, BH15 1JF
United Kingdom
