2025-03-04 (Tuesday) : Group Claiming To Be BianLian Sends Paper-Based Extortion Letters via Postal Service

On March 4, 2025, a group claiming to be the notorious threat actor BianLian began sending paper-based extortion letters to executives at U.S.-based organizations.

These letters demand ransom payments in Bitcoin to prevent the alleged disclosure of sensitive data, with amounts ranging from $200,000 to $500,00013.

However, several factors suggest that these letters may not be from the actual BianLian group but rather from impostors attempting to leverage the group’s reputation for financial gain.

Key Features Of The Letters

• Lack of Negotiation Channels: Unlike typical extortion notes from BianLian, these letters do not provide a means for victims to contact the threat actors for negotiations. This is unusual, as negotiation channels are often included to facilitate ransom payments.
• No Evidence of Data Exfiltration: The letters fail to provide any evidence that data was actually exfiltrated, which is a common practice in extortion attempts to validate claims.
• Composition and Language: The language used in these letters is well-formatted and well-written, differing significantly from the more broken English typically seen in BianLian’s communications.

Tools And Tactics Used By BianLian

BianLian is known for employing a double-extortion model, where they exfiltrate data and threaten to release it unless a ransom is paid.

The group primarily uses tools like File Transfer Protocol (FTP), Rclone, or Mega for data exfiltration. They typically leave victims’ systems intact, focusing solely on data extortion rather than encrypting systems.

Organizations receiving these letters are advised to contact law enforcement rather than complying with the demands.

The lack of evidence and unusual tactics suggest that these letters may be part of a scam rather than a genuine threat from BianLian.

As cybersecurity threats evolve, vigilance and collaboration with law enforcement are crucial in mitigating such risks.

In summary, while the letters claim to be from BianLian, their characteristics suggest they may be from impostors. Organizations should remain cautious and seek professional advice if they receive such communications.