BianLian Ransomware Spreads via Fake Invoice SVG Images in New Attacks

WatchGuard researchers identified a phishing campaign targeting Venezuelan companies that delivers BianLian-linked ransomware via malicious SVG image files which download a Go-built Windows payload. The campaign uses ja.cat link shortening and redirection through compromised Brazilian domains, performs environment checks (e.g., Wine, GODEBUG), and executes fast AES file encryption; researchers published multiple suspicious domains to monitor or block.