The BianLian Ransomware Gang's Attack on Kramer Tree Specialists

The BianLian ransomware gang has attacked Kramer Tree Specialists. Kramer Tree Specialists is a professional tree care company that provides a range of services related to tree maintenance, preservation, and removal. They work with residential, commercial, and municipal clients to address various tree-related needs. BianLian posted Kramer Tree Specialists to its data leak site on September 26th, claiming to have stolen 450GB of company data.

BianLian's Evolution

BianLian is not a traditional RaaS. They first emerged in June 2022 as a typical RaaS provider with Golang-based ransomware until a decrypter was released. In early 2023, they appear to have abandoned the ransomware payload portion of attacks in favor of less complicated data exfiltration and extortion attacks. This shows how successful the double extortion strategy is for ransomware groups, and we will likely see more groups join the likes of BianLian (and Karakurt before them).

Techniques and Strategies

BianLian leverages open-source tooling and command-line scripts to engage in credential harvesting and data exfiltration. BianLian increased attack volumes as they have moved away from deploying ransomware payloads in favor of pure data extortion attacks, making them one of the more prominent groups in Q1-2023, although still lagging far behind leaders.

Ransom Demands

It is unclear how much BianLian typically requests for a ransom amount, or if they are keen to negotiate the demand down.