Security News > 2022 > September > Researchers Detail Emerging Cross-Platform BianLian Ransomware Attacks
The operators of the emerging cross-platform BianLian ransomware have increased their command-and-control infrastructure this month, a development that alludes to an increase in the group's operational tempo.
"BianLian has also targeted SonicWall VPN devices for exploitation, another common target for ransomware groups," [redacted] researchers Ben Armstrong, Lauren Pearce, Brad Pittack, and Danny Quist said.
Unlike another new Golang malware called Agenda, the BianLian actors exhibit dwell times of up to six weeks from the time of initial access and the actual encryption event, a duration that's well above the median intruder dwell time of 15 days reported in 2021.
The earliest known C2 server associated with BianLian is said to have appeared online in December 2021.
BianLian is yet another indication of cybercriminals' dedicated efforts to continue hopping tactics so as to avoid detection.
"BianLian have shown themselves to be adept with the Living of the Land methodology to move laterally, adjusting their operations based on the capabilities and defenses they encountered in the network," the researchers said.
News URL
https://thehackernews.com/2022/09/researchers-detail-emerging-cross.html
Related news
- Southern Water says Black Basta ransomware attack cost £4.5M in expenses (source)
- Qilin ransomware claims attack at Lee Enterprises, leaks stolen data (source)
- Ransomware gangs exploit Paragon Partition Manager bug in BYOVD attacks (source)
- Hackers Exploit Paragon Partition Manager Driver Vulnerability in Ransomware Attacks (source)
- Hunters International ransomware claims attack on Tata Technologies (source)
- Researchers Link CACTUS Ransomware Tactics to Former Black Basta Affiliates (source)
- Toronto Zoo shares update on last year's ransomware attack (source)
- Researchers Expose New Polymorphic Attack That Clones Browser Extensions to Steal Credentials (source)
- Ransomware gang creates tool to automate VPN brute-force attacks (source)
- SANS Institute Warns of Novel Cloud-Native Ransomware Attacks (source)