Security News > 2022 > September > Researchers Detail Emerging Cross-Platform BianLian Ransomware Attacks

The operators of the emerging cross-platform BianLian ransomware have increased their command-and-control infrastructure this month, a development that alludes to an increase in the group's operational tempo.

"BianLian has also targeted SonicWall VPN devices for exploitation, another common target for ransomware groups," [redacted] researchers Ben Armstrong, Lauren Pearce, Brad Pittack, and Danny Quist said.

Unlike another new Golang malware called Agenda, the BianLian actors exhibit dwell times of up to six weeks from the time of initial access and the actual encryption event, a duration that's well above the median intruder dwell time of 15 days reported in 2021.

The earliest known C2 server associated with BianLian is said to have appeared online in December 2021.

BianLian is yet another indication of cybercriminals' dedicated efforts to continue hopping tactics so as to avoid detection.

"BianLian have shown themselves to be adept with the Living of the Land methodology to move laterally, adjusting their operations based on the capabilities and defenses they encountered in the network," the researchers said.

News URL

https://thehackernews.com/2022/09/researchers-detail-emerging-cross.html