Bianlian

BianLian ransomware operations began in late 2021. The group practices multi-pronged extortion, demanding payment for a decryptor, as well as the non-release of stolen data. The ransomware group hosts a public, TOR-based, blog to post victim identities and stolen data. Somewhat unique to BianLian at the time of their launch was their inclusion of an I2P mirror for their blog.

Victims

553

First Discovered

2022-07-14

victim

Last Discovered

2025-03-31

victim

Inactive Since

353

days

Avg Delay

46.6

days

Infostealer

3.0%

victims with domain

View Victims on World Map

View group statistics

Known Locations (3)

Title	Available	Last Visit	FQDN
BianLian \| Home	No	2025-06-01 21:18:19	`bianlianlbc5an4kgnay3opdemgcryg2kpfcbgczopmm3dnbz3uaunad.onion`
BianLian \| Home	No	2025-06-01 21:18:29	`bianlivemqbawcco4cx4a672k2fip3guyxudzurfqvdszafam3ofqgqd.onion`
	No	2025-06-01 21:18:36	`bianliaoxoeriowgqohcly4a6sbkpc3se2yvxgidxomxlpuhx5ehrpad.onion`

Target (Available)

Heatmap (Available)

Ransom Notes (1)

Tools Used (Available)

This information is provided by Ransomware-Tool-Matrix
Discovery	RMM Tools	Defense Evasion	Credential Theft	OffSec	Networking	LOLBAS	Exfiltration
Advanced IP Scanner Advanced Port Scanner PingCastle SharpShares SoftPerfect NetScan WKTools	AnyDesk AmmyyAdmin Atera ScreenConnect Splashtop TeamViewer	placeholder placeholder placeholder placeholder placeholder placeholder	RDP Recognizer placeholder placeholder placeholder placeholder placeholder	Impacket placeholder placeholder placeholder placeholder placeholder	placeholder placeholder placeholder placeholder placeholder placeholder	PsExec placeholder placeholder placeholder placeholder placeholder	MEGA RClone placeholder placeholder placeholder placeholder

Vulnerabilities Exploited (0)

TTPs Matrix (5)

This information is provided by Crocodyli & Ransomware.live
Execution	Defense Evasion	Discovery	Impact	Lateral Movement
User Execution	Virtualization/Sandbox Evasion	System Information Discovery	Data Encrypted for Impact	Replication Through Removable Media
Command and Scripting Interpreter	Software Packing	File and Directory Discovery
	Masquerading	Security Software Discovery
		Peripheral Device Discovery

Negotiation Chats (0)

YARA Rules (1)

Indicators of Compromise (IoCs) (199)

IP 191 MD5 8

Type	IOC
`ip`	`88.212.241.105:993`
`ip`	`91.245.255.27:8443`
`ip`	`162.33.179.99:1433`
`ip`	`151.236.16.144:64250`
`ip`	`172.96.137.108:80`
`ip`	`31.220.80.82:8081`
`ip`	`104.238.35.179:38901`
`ip`	`151.236.16.242:12818`
`ip`	`104.238.35.179:3389`
`ip`	`85.235.151.5:8080`
`ip`	`5.255.106.12:80`
`ip`	`23.227.198.237:13937`
`ip`	`5.255.106.12:3389`
`ip`	`98.82.12.229:80`
`ip`	`172.96.137.32:80`
`ip`	`64.52.80.103:3544`
`ip`	`104.200.73.216:43696`
`ip`	`104.238.57.233:80`
`ip`	`51.250.0.16:443`
`ip`	`44.201.115.56:443`
`ip`	`69.46.15.169:80`
`ip`	`69.46.15.169:3389`
`ip`	`162.252.173.100:80`
`ip`	`81.17.31.98:1124`
`ip`	`3.86.153.4:443`
`ip`	`94.198.40.6:20022`
`ip`	`128.254.230.110:443`
`ip`	`62.210.28.199:80`
`ip`	`208.73.200.28:9999`
`ip`	`85.239.54.99:23443`
`ip`	`89.46.235.60:8443`
`ip`	`185.76.79.26:24443`
`ip`	`104.225.129.141:4018`
`ip`	`104.238.57.44:56099`
`ip`	`108.61.216.142:443`
`ip`	`23.227.198.237:57226`
`ip`	`108.61.216.142:1433`
`ip`	`104.225.129.101:8465`
`ip`	`108.61.216.142:5060`
`ip`	`94.198.40.6:20028`
`ip`	`104.200.67.252:50955`
`ip`	`104.225.129.141:80`
`ip`	`185.87.49.47:443`
`ip`	`104.238.35.179:80`
`ip`	`94.198.40.6:20025`
`ip`	`104.200.67.252:3966`
`ip`	`3.64.60.12:443`
`ip`	`23.227.198.237:50262`
`ip`	`104.200.72.146:80`
`ip`	`23.227.198.237:20451`
`ip`	`104.200.72.146:3389`
`ip`	`104.225.129.101:63618`
`ip`	`151.236.22.19:3375`
`ip`	`62.210.28.199:443`
`ip`	`86.107.101.94:80`
`ip`	`104.200.73.216:3389`
`ip`	`86.106.87.158:3389`
`ip`	`86.106.87.158:80`
`ip`	`104.200.73.216:80`
`ip`	`62.210.28.199:8443`
`ip`	`86.107.101.94:3389`
`ip`	`64.52.80.103:6798`
`ip`	`85.239.54.99:5362`
`ip`	`185.239.48.114:27700`
`ip`	`94.198.40.6:20002`
`ip`	`104.238.57.44:64598`
`ip`	`85.239.54.99:3126`
`ip`	`85.239.54.99:80`
`ip`	`185.241.5.217:8081`
`ip`	`62.234.69.114:443`
`ip`	`5.187.48.26:8443`
`ip`	`45.76.144.235:443`
`ip`	`45.61.136.118:443`
`ip`	`23.254.244.163:443`
`ip`	`206.237.4.54:8080`
`ip`	`195.230.23.91:8443`
`ip`	`164.92.223.252:443`
`ip`	`146.19.24.84:8443`
`ip`	`107.189.26.195:8443`
`ip`	`104.168.140.238:443`
`ip`	`104.168.151.112:443`
`ip`	`94.198.40.6:20001`
`ip`	`151.236.22.19:4421`
`ip`	`45.41.187.117:5973`
`ip`	`85.239.53.59:6316`
`ip`	`185.76.79.26:51835`
`ip`	`95.179.233.26:8090`
`ip`	`89.38.225.185:443`
`ip`	`23.227.198.237:64103`
`ip`	`52.12.243.110:8888`
`ip`	`154.216.17.241:443`
`ip`	`142.93.234.59:443`
`ip`	`194.213.18.181:49493`
`ip`	`167.71.69.135:443`
`ip`	`184.94.215.147:53`
`ip`	`104.225.129.101:35247`
`ip`	`45.129.199.234:80`
`ip`	`185.193.48.92:4675`
`ip`	`185.229.9.27:993`
`ip`	`151.236.16.40:57144`
`ip`	`69.197.176.26:8443`
`ip`	`151.236.16.40:2014`
`ip`	`208.123.119.103:7453`
`ip`	`70.34.202.129:8443`
`ip`	`185.76.79.207:9977`
`ip`	`45.130.147.118:443`
`ip`	`104.36.229.179:5729`
`ip`	`154.203.197.96:8443`
`ip`	`151.236.16.40:34236`
`ip`	`85.239.52.16:2083`
`ip`	`85.239.52.16:2443`
`ip`	`91.236.230.33:6399`
`ip`	`64.95.11.206:10443`
`ip`	`104.238.60.168:2602`
`ip`	`88.218.168.33:8443`
`ip`	`181.215.39.2:4444`
`ip`	`181.215.39.2:8443`
`ip`	`104.225.129.141:46464`
`ip`	`45.61.136.147:3917`
`ip`	`45.61.136.147:3929`
`ip`	`87.121.61.252:443`
`ip`	`147.45.154.131:443`
`ip`	`147.45.141.206:8443`
`ip`	`64.95.11.206:5060`
`ip`	`185.163.193.251:443`
`ip`	`216.219.94.99:80`
`ip`	`65.21.153.27:8443`
`ip`	`64.95.11.206:1433`
`ip`	`91.236.230.33:6400`
`ip`	`64.95.11.206:443`
`ip`	`51.16.209.105:443`
`ip`	`8.140.226.110:443`
`ip`	`170.130.55.197:8443`
`ip`	`103.125.217.129:80`
`ip`	`194.213.18.181:16963`
`ip`	`185.28.119.50:5415`
`ip`	`37.1.202.248:8443`
`ip`	`185.193.48.92:445`
`ip`	`104.225.129.141:2244`
`ip`	`23.227.198.237:3963`
`ip`	`92.243.66.51:8024`
`ip`	`85.239.54.36:2866`
`ip`	`104.200.72.15:10403`
`ip`	`144.208.127.130:14906`
`ip`	`203.161.43.187:53`
`ip`	`159.89.112.223:443`
`ip`	`87.120.114.51:20000`
`ip`	`193.124.185.129:8443`
`ip`	`86.104.72.238:8443`
`ip`	`194.213.18.181:20290`
`ip`	`104.36.229.149:28333`
`ip`	`172.96.137.106:4567`
`ip`	`194.68.27.93:40812`
`ip`	`45.95.175.213:8443`
`ip`	`194.36.188.25:80`
`ip`	`169.239.130.36:993`
`ip`	`104.36.229.149:5168`
`ip`	`89.23.113.220:8083`
`ip`	`85.239.54.36:5603`
`ip`	`146.70.143.147:18095`
`ip`	`151.236.16.40:10351`
`ip`	`62.60.211.206:8080`
`ip`	`185.76.79.207:38378`
`ip`	`51.250.44.190:8443`
`ip`	`43.198.93.208:443`
`ip`	`77.73.67.162:8080`
`ip`	`143.198.179.167:5060`
`ip`	`143.198.179.167:1433`
`ip`	`92.243.64.200:7258`
`ip`	`86.107.101.47:24553`
`ip`	`143.198.179.167:443`
`ip`	`51.250.27.83:443`
`ip`	`216.181.107.134:41296`
`ip`	`89.1.88.252:443`
`ip`	`130.193.52.194:443`
`ip`	`158.160.3.224:443`
`ip`	`79.141.162.184:80`
`ip`	`194.68.27.93:53312`
`ip`	`167.88.160.15:8080`
`ip`	`165.227.69.170:1433`
`ip`	`165.227.69.170:443`
`ip`	`85.239.53.248:6219`
`ip`	`96.44.156.220:24467`
`ip`	`43.248.136.194:443`
`ip`	`103.30.77.80:8443`
`ip`	`203.161.43.195:444`
`ip`	`172.187.180.204:443`
`ip`	`13.38.235.203:443`
`ip`	`13.37.127.130:443`
`ip`	`18.159.131.20:80`
`ip`	`185.243.112.167:80`
`md5`	`36171704cde087f839b10c2465d864e1`
`md5`	`d10e0387e3d55dc1f82c23719e2b168b`
`md5`	`0c756fc8f34e409650cd910b5e2a3f00`
`md5`	`b3cdf0489ff37fe65141be9363b9489c`
`md5`	`08e76dd242e64bb31aec09db8464b28f`
`md5`	`14da9c0c4e3ac3b9abb2c48b37bece19`
`md5`	`15cdfa777aa2db35229410d2fa9fb92e`
`md5`	`7be61ea851f894d26bf57cf0f1f55ed6`