BianLian emerged as a relatively new ransomware actor deploying Go-based malware and using LOL (Living off the Land) techniques to move laterally while evading EDR during encryption. They exploited initial access vectors like ProxyShell and SonicWall VPNs, rapidly expanding their C2 infrastructure and aggressively encrypting victim networks while targeting defenses. #BianLian #ProxyShell
Keypoints
- New ransomware actor, BianLian, develops and uses a Go-based encryptor and backdoors, indicating a skilled yet relatively new extortion operation.
- Initial access primarily achieved through ProxyShell exploitation and SonicWall VPN devices, with indications of targeting remote access servers.
- LOL-based lateral movement includes backdoors created with nssm.exe and ngrok.exe, plus use of RDP, WinRM, WMI, and PowerShell for network profiling and movement.
- Defense evasion efforts include disabling Defender/AMSI, tampering with firewall rules, and registry adjustments to remote desktop and security policies.
- The encryptor operates with an evolving ransom note and a file-extension exclusion model, dropping known-good binaries for exfiltration and expanding target coverage over time.
- Infrastructure expanded in August, with a threefold increase in active C2 nodes, suggesting higher operational tempo and resource availability.
MITRE Techniques
- [T1190] Initial Access: Exploit Public-Facing Application – The BianLian group has successfully targeted the ProxyShell vulnerability chain (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) to gain initial access into victim networks. “The BianLian group has successfully targeted the ProxyShell vulnerability chain … to gain initial access into victim networks.”
- [T1047] Execution: Windows Management Instrumentation – They leveraged RDP, WinRM, WMI, and PowerShell to achieve network profiling and lateral movement. “they leveraged RDP, WinRM, WMI, and PowerShell to achieve network profiling and lateral movement.”
- [T1059.001] Execution: Command and Scripting Interpreter: PowerShell – PowerShell is used in conjunction with other LOL tools for execution and lateral movement. “PowerShell” is among the tools used to achieve network profiling and lateral movement.
- [T1098] Persistence: Account Manipulation – They create/modify administrator accounts on multiple servers as part of persistence. “create administrator accounts on multiple servers” (sample timeline mentions enabling admin accounts and password changes).
- [T1078] Persistence: Valid Accounts – Use of admin accounts and persistent access to remote systems. “Admin accounts enabled and existing admin account passwords changed…”
- [T1562.001] Defense Evasion: Impair Defenses: Disable or Modify Tools – Targeting Windows Defender with disable commands. “Targeting Windows Defender” and related DISM commands to disable Defender.
- [T1526.004] Defense Evasion: Impair Defenses: Disable or Modify System Firewall – Modifying firewall rules via netsh to allow Remote Desktop access. “netsh to configure host firewall policies” and specific firewall rule additions.
- [T1036] Defense Evasion: Masquerading – Using svchost-style tool names and non-standard paths to hide tools. “called one of their LOL tools svchost, then launched it via a process other than services.exe.”
- [T1112] Defense Evasion: Modify Registry – Adjusting registry to enable/modify RDP and security policy enforcement. “reg.exe to adjust various registry settings related to remote desktop and security policy enforcement.”
- [T1069] Discovery: Permission Groups Discovery – Modifying user groups/permissions to identify targets and prepare encryption. “net.exe localgroup … /add” demonstrates permission changes.
- [T1018] Discovery: Remote System Discovery – Profiling and identifying target systems for encryption and data exfiltration. “network profiling” and targeted host selection.
- [T1021.001] Lateral Movement: Remote Services: Remote Desktop Protocol – Using RDP to move laterally. “RDP” is mentioned as a means of movement.
- [T1021.005] Lateral Movement: Remote Services: VNC – Backdoors and remote access methods enabling lateral movement via remote services. (Referenced in MITRE mapping in the article.)
- [T1021.006] Lateral Movement: Remote Services: Windows Remote Management – WMI/WinRM usage for lateral movement. “WinRM” and “WMI” are used for movement.
- [T1090] Command and Control: Proxy – Use of proxy-like tools to conceal C2 communications. “proxy” is cited in the malware’s behavior.
- [T1071.001] Command and Control: Application Layer Protocol: Web Protocol – Web-based C2 channels via web payloads or ngrok/webshell. “webshell or lightweight remote access solution such as ngrok” and “Web Protocol” C2 used.
- [T1486] Impact: Data Encrypted for Impact – Encryption of victim data during the encryption phase. “encryption event” and observed encryption attempts.
Indicators of Compromise
- [Hash] Backdoors – 001f33dd5ec923afa836bb9e8049958decc152eeb6f6012b1cb635cff03be2a2, 1a1177363be7319e7fb50ac84f69acb633fd51c58f7d2d73a1d5efb5c376f256, and 2 more hashes
- [Hash] Encryptors – 1fd07b8d1728e416f897bef4f1471126f9b18ef108eb952f4b75050da22e8e43, b60be0b5c6e553e483a9ef9040a9314dd54335de7050fed691a07f299ccb8bc6, and 2 more hashes
- [IP] Active IPs – 104.225.129[.]86, 104.238.223[.]10, and other active IPs
- [IP] Historical IPs – 104.207.155[.]133, 104.238.61[.]153, and other historical IPs
- [IP] Historical C2s – 104.238.61[.]153, 146.70.44[.]248, and other historical C2s
- [IP] Active C2s – 104.225.129[.]86, 104.238.223[.]10, 104.238.223[.]3, and other active C2s
- [Hash] Encryptors – 1fd07b8d1728e416f897bef4f1471126f9b18ef108eb952f4b75050da22e8e43, b60be0b5c6e553e483a9ef9040a9314dd54335de7050fed691a07f299ccb8bc6, and 2 more
- [Backdoor] Active backdoor hashes – 001f33dd5ec923afa836bb9e8049958decc152eeb6f6012b1cb635cff03be2a2, 1a1177363be7319e7fb50ac84f69acb633fd51c58f7d2d73a1d5efb5c376f256
- [Historical C2s] – 23.94.56[.]154, 104.207.155[.]133, etc. (historical C2s listed in article)