BianLian Data Extortion Group Targets Reeves-Wiedeman

The BianLian data extortion group has attacked Reeves-Wiedeman in a recent cyber attack. Based on the leaked data, it appears that the ransomware threat actor has compromised a significant amount of sensitive information. The leaked data includes various types of files and data, such as:

• Business documents and financial information
• Personal and confidential information
• Medical records and health data
• Technical and engineering documents
• Legal and regulatory compliance documents

Reeves-Wiedeman Company is a plumbing wholesaler based out of Kansas City, Missouri. It has been family-owned since its inception in 1887 and now has 22 locations.

The Evolution of BianLian

The BianLian data extortion group first emerged in June 2022 as a typical RaaS (Ransomware-as-a-Service) provider with Golang-based ransomware until a decrypter was released. In early 2023, they appeared to have abandoned the ransomware payload portion of attacks in favor of less complicated data exfiltration and extortion attacks. This shows how successful the double extortion strategy is for ransomware groups, and we will likely see more groups join the likes of BianLian (and Karakurt before them).

Techniques and Targets

BianLian leverages open-source tooling and command-line scripts to engage in credential harvesting and data exfiltration. BianLian increased attack volumes as they moved away from deploying ransomware payloads in favor of pure data extortion attacks, making them one of the more prominent groups in Q1-2023, although they still lagging far behind leaders.

It is unclear how much BianLian typically requests for a ransom amount or if they are keen to negotiate the demand down. BianLian successfully attacked several high-profile organizations before a free decryption tool was released to help victims recover files encrypted by ransomware. The group abandoned the RaaS model in favor of pure data extortion attacks where data is exfiltrated and ransom demand issued, but no ransomware is deployed.

BianLian has been observed deploying a custom Go-based backdoor for remote access. BianLian uses PowerShell and Windows Command Shell to bypass and evade security solutions. BianLian primarily targets financial institutions, healthcare, manufacturing, education, entertainment, and energy sectors by leveraging compromised Remote Desktop Protocol (RDP) credentials. Almost exclusively a data extortion attack group now, BianLian is rarely observed deploying ransomware payloads.