Ransomware Hits Law Firm: BianLian Targets Fish Nelson & Holden
Ransomware Attack on Fish Nelson & Holden by BianLian Group
Fish Nelson & Holden, a Birmingham, Alabama-based law firm specializing in insurance defense litigation, has become the latest victim of a ransomware attack orchestrated by the notorious BianLian group. The firm, known for its expertise in defending premises liability, products liability, personal injury, property loss, workers' compensation, and employment law cases, primarily serves insurance carriers and self-insured employers.
Company Profile and Industry Standing
Established in 2007, Fish Nelson & Holden operates as a Limited Liability Company (LLC) and employs a small team of six attorneys. Despite its modest size, the firm has garnered recognition for its personalized client service and has received accolades such as "Top 40 under 40" and "Best of the Bar." The firm's annual revenue ranges from $1 million to $5 million, reflecting its focused practice in a niche area of law.
Attack Overview
The BianLian ransomware group has claimed responsibility for the attack, which resulted in the compromise of 1TB of sensitive data. The stolen data includes medical and lab test files of clients, accounting and financial records, contract data, non-disclosure agreements, accident reports, files from top management's PCs, operational and business documents, as well as email and message archives. This breach poses significant risks to the firm's operations, client confidentiality, and overall business integrity.
About BianLian Ransomware Group
BianLian is a sophisticated ransomware group that has evolved from targeting individual users to launching high-profile attacks on businesses and organizations globally. Initially functioning as a banking trojan, BianLian transitioned into advanced ransomware operations, emphasizing extortion-based strategies. The group is known for its exfiltration-based extortion tactics, threatening victims with financial, business, and legal consequences if payment is not made.
Penetration and Vulnerabilities
BianLian typically gains initial access through compromised Remote Desktop Protocol (RDP) credentials, implanting custom backdoors specific to each victim. The group uses PowerShell and Windows Command Shell for defense evasion and employs various tools for discovery, lateral movement, collection, exfiltration, and impact. The firm's reliance on sensitive client data and its relatively small size may have made it an attractive target for the ransomware group.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!