BianLian Ransomware Exploits RDP Credentials for Initial Access

**Executive Summary:** BianLian is an active, prolific ransomware group that has shifted from pure encryption to double-extortion, exploiting RDP credentials and notable vulnerabilities (ProxyShell, SonicWall) while using custom Go-based backdoors and TLS-encrypted C2 infrastructure with identifiable certificate patterns; it targets high-value sectors (notably legal and healthcare) and provides huntable IoCs such as unique Go libraries, certificate subject/issuer patterns, ports, and ASNs.