The ransomware group that once encrypted hospital networks stopped locking files entirely in January 2024, and CISA says the switch was driven by a free decryption tool that made encryption a losing business model.

 

What happened

CISA, the FBI, and the Australian Cyber Security Centre have issued an updated advisory confirming that BianLian, a ransomware group active since at least June 2022, has shifted exclusively to data-theft extortion, abandoning file encryption entirely. According to BleepingComputer, the update builds on a joint advisory the same agencies released earlier, which had already flagged BianLian's move toward stolen Remote Desktop Protocol credentials, custom backdoors written in the Go programming language, commercial remote access tools, and targeted changes to Windows Registry settings. The agencies now confirm the group has relied exclusively on stealing data and threatening to publish it, rather than encrypting victim systems, since January 2024. Most of BianLian's victims are small to medium-sized organizations, though the group has also claimed high-profile breaches including Air Canada, a Northern Minerals mining operation, and Boston Children's Health Physicians, a network of more than 300 pediatric physicians.

 

Going deeper

The change away from encryption traces to a specific technical setback. According to SecurityWeek, Avast released a free public decryptor for BianLian's encryption in January 2023, giving victims a way to recover their files without paying. BleepingComputer notes that BianLian continued using encryption in some attacks through the end of 2023 despite the decryptor's availability, before the updated CISA advisory confirms the group moved to data theft exclusively from January 2024 onward. BianLian's access method has stayed consistent throughout this change. The group gains entry primarily through stolen RDP credentials, obtained either from initial access brokers who sell previously compromised logins or through the group's own phishing campaigns. Once inside a network, BianLian uses PsExec and RDP with the credentials it already controls to move between systems, then creates a new account within the Remote Desktop Users group and modifies that account's password and firewall rules to maintain access that survives beyond the original compromised credential.

 

What was said

The joint advisory notes that BianLian, assessed by the FBI as likely Russia-based, has used its name and foreign-language branding specifically to complicate attribution efforts. According to The Record, the FBI and Australian Cyber Security Centre stated the group has used "foreign-language names, almost certainly to complicate attribution efforts" in a pattern common among Russia-based ransomware operations seeking to obscure their true origin and nationality.

 

In the know

BianLian's pivot away from encryption shows a shift in the ransomware ecosystem toward pure extortion models. Encrypting a victim's systems creates immediate, visible operational disruption that pressures faster law enforcement involvement and, once free decryptors exist, gives victims a path to recovery that removes the group's core advantage entirely. According to BleepingComputer's coverage of the WorldLeaks extortion group, that group made the same calculated change after its predecessor operation, Hunters International, wound down its ransomware business in 2025 and pivoted to a data-theft-only model for the same underlying reason, extortion through publication threat retains pressure on the victim without the operational and legal exposure that active encryption campaigns carry.

 

The big picture

For healthcare organizations, BianLian's confirmed access method matters more than its extortion model. A group that gains entry through exposed or stolen RDP credentials and never encrypts a single file produces none of the operational alarm bells that a traditional ransomware attack triggers. Systems keep running normally throughout the intrusion, and detection depends entirely on identifying unusual authentication activity, lateral movement, and outbound data transfer volume rather than responding to a visible outage. According to CISA's joint advisory on BianLian, organizations should specifically audit remote access services, implement time-based access for privileged accounts, and require phishing-resistant multi-factor authentication for all remote and administrative access to close the exact entry points the group has consistently relied on. Organizations that have hardened their networks specifically against encryption-based ransomware, focusing on backup and recovery capability, may have far less visibility into the credential-based access and quiet data exfiltration that groups like BianLian now rely on exclusively.

 

FAQs

Why did BianLian stop encrypting victim systems entirely?

A free public decryptor released in January 2023 undermined the group's ability to force ransom payments through file encryption, since victims could recover their data without paying once that tool became available. CISA's updated advisory confirms the group moved to a pure data-theft extortion model exclusively from January 2024 onward.

 

What specific vulnerability does BianLian consistently exploit to gain initial access?

The group primarily uses stolen Remote Desktop Protocol credentials, sourced either from initial access brokers selling previously compromised logins or through its own phishing campaigns, rather than exploiting a specific software vulnerability or zero-day flaw.

 

How does BianLian maintain access once inside a victim's network?

The group uses PsExec and RDP with the credentials it already controls to move laterally between systems, then adds a new account to the Remote Desktop Users group and modifies that account's password and firewall rules, establishing persistent access that does not depend on the originally compromised credential remaining valid.

 

Why is a data-theft-only attack harder for security teams to detect than encryption-based ransomware?

Without file encryption, there is no immediate operational disruption to alert an organization that something is wrong. Detection depends on identifying anomalous authentication patterns, unusual RDP activity, and large-volume outbound data transfers in real time, rather than responding to a visible system outage that traditional ransomware produces.

 

What security controls most directly address BianLian's known attack pattern?

Restricting RDP access from the public internet, enforcing multi-factor authentication on all remote access accounts, monitoring for new accounts added to remote access groups, and actively watching for large or unusual outbound data transfers together address the specific access and persistence methods CISA's advisory confirms BianLian relies on.