#StopRansomware: BianLian Ransomware Group

## Executive summary FBI, CISA, and ASD's ACSC released a joint advisory on the BianLian ransomware and data extortion group, detailing observed tactics (RDP/valid-accounts, ProxyShell exploitation), custom Go backdoors, credential harvesting (LSASS, NTDS), exfiltration methods (Rclone, FTP, Mega), sample ransom notes, and IOCs (file hashes). The advisory notes a shift from double-extortion with encryption to primarily exfiltration-based extortion, impacts to multiple U.S. and Australian critical infrastructure and private sectors, and provides mitigations and detection recommendations.