Fake BianLian Ransom Demands Sent via Physical Letters to U.S. Firms

In a novel and concerning development, multiple U.S. organizations have reported receiving suspicious physical letters claiming to be from the BianLian ransomware group.

These letters, sent via U.S. postal services, threaten recipients with data leaks unless substantial ransoms are paid within a specified timeframe.

The letters are part of a campaign that GRIT assesses with high confidence to be illegitimate, not originating from the actual BianLian ransomware group.

Unusual Delivery Mechanism and Indicators of Deception

The use of physical mail to deliver ransom demands is an unusual tactic, as legitimate ransomware groups typically communicate digitally.

The letters include Bitcoin wallet addresses and QR codes for payment, along with Tor links to BianLian’s data leak sites.

However, these links are publicly known and do not confirm the legitimacy of the threats.

The language and content of the letters also deviate from typical ransom notes, featuring nearly perfect English and complex sentence structures, which is inconsistent with past communications from BianLian.

Moreover, the Bitcoin wallet addresses included in the letters are freshly generated and have no ties to known ransomware groups.

According to Guidepoint Security Report, this suggests that the true intention is to deceive and scam executives into paying ransoms without any actual network compromise.

GRIT has not observed any known or suspected intrusion activity associated with these letters, further supporting the assessment that they are part of a scam.

Recommendations for Response

In response to these threats, organizations are advised to educate their employees on how to handle ransom threats, whether legitimate or not.

It is crucial to ensure that network defenses are up-to-date and to report incidents to local law enforcement, including the FBI.

Despite the lack of evidence linking these letters to actual network compromises, vigilance is necessary to protect against potential historical leaks or future attacks.

Organizations should also be cautious about the advice in the letters to avoid involving law enforcement, as this is a common tactic used by scammers to isolate victims and prevent them from seeking professional help.

Instead, reporting these incidents can help in identifying and disrupting the scam operations.

Collect Threat Intelligence on the Latest Malware and Phishing Attacks with ANY.RUN TI Lookup -> Try for free