CISA says BianLian ransomware now focuses only on data theft

The advisory reports that the BianLian ransomware operation has shifted to exclusively exfiltration-based extortion as of January 2024, using stolen RDP credentials, custom Go backdoors, commercial remote access tools, and Windows/ESXi targeting (including possible ProxyShell exploitation). Agencies (CISA/FBI/ACS) detail TTPs—Ngrok/Rsocks SOCKS5 tunneling, privilege-escalation (CVE-2022-37969), UPX packing, service renaming, webshells on Exchange, PowerShell compression, and victim-pressure tactics—and recommend restricting RDP, command-line/scripting, and PowerShell usage.