[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) English * [English](https://unit42.paloaltonetworks.com/bianlian-ransomware-group-threat-assessment/) * [Japanese](https://unit42.paloaltonetworks.com/ja/bianlian-ransomware-group-threat-assessment/) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/ "High Profile Threats") * [Ransomware](https://unit42.paloaltonetworks.com/category/ransomware/ "Ransomware") [Ransomware](https://unit42.paloaltonetworks.com/category/ransomware/) # Threat Assessment: BianLian ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 10 min read Related Products [![Advanced URL Filtering icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced URL Filtering](https://unit42.paloaltonetworks.com/product-category/advanced-url-filtering/ "Advanced URL Filtering")[![Advanced WildFire icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced WildFire](https://unit42.paloaltonetworks.com/product-category/advanced-wildfire/ "Advanced WildFire")[![Cloud-Delivered Security Services icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Cloud-Delivered Security Services](https://unit42.paloaltonetworks.com/product-category/cloud-delivered-security-services/ "Cloud-Delivered Security Services")[![Cortex XDR icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XDR](https://unit42.paloaltonetworks.com/product-category/cortex-xdr/ "Cortex XDR")[![Next-Generation Firewall icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Next-Generation Firewall](https://unit42.paloaltonetworks.com/product-category/next-generation-firewall/ "Next-Generation Firewall") * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Daniel Frank](https://unit42.paloaltonetworks.com/author/daniel-frank/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:January 23, 2024 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [Cybercrime](https://unit42.paloaltonetworks.com/category/cybercrime/) * [High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) * [Ransomware](https://unit42.paloaltonetworks.com/category/ransomware/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [BianLian](https://unit42.paloaltonetworks.com/tag/bianlian/) * [Bitter Scorpius](https://unit42.paloaltonetworks.com/tag/bitter-scorpius/) * [Makop](https://unit42.paloaltonetworks.com/tag/makop/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/bianlian-ransomware-group-threat-assessment/?pdf=download&lg=en&_wpnonce=40dbae5d0f "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/bianlian-ransomware-group-threat-assessment/?pdf=print&lg=en&_wpnonce=40dbae5d0f "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=Threat%20Assessment:%20BianLian&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fbianlian-ransomware-group-threat-assessment%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Fbianlian-ransomware-group-threat-assessment%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fbianlian-ransomware-group-threat-assessment%2F&title=Threat%20Assessment:%20BianLian "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fbianlian-ransomware-group-threat-assessment%2F&text=Threat%20Assessment:%20BianLian "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fbianlian-ransomware-group-threat-assessment%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=Threat%20Assessment:%20BianLian%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fbianlian-ransomware-group-threat-assessment%2F "Share in Mastodon") ## Executive Summary Unit 42 researchers have been tracking the BianLian ransomware group, which has been in the top 10 of the most active groups based on leak site data we've gathered. From that leak site data, we've primarily observed activity affecting the healthcare and manufacturing sectors and industries, and impacting organizations mainly in the United States (US) and Europe (EU). We also observed that the BianLian group shares a small, customized tool in common with the Makop ransomware group. This shared tool indicates a possible connection between the two groups, which we will explore further. BianLian has also recently moved from a double extortion scheme to one of extortion without encryption. Rather than encrypting their victims' assets before stealing data and threatening to publish it if they do not pay the ransom, they're now moving straight to stealing data to motivate victims to pay. The Unit 42 Incident Response team has responded to several BianLian ransomware incidents since September 2022. Palo Alto Networks customers are better protected against ransomware used by the BianLian ransomware group through [Cortex XDR](https://docs-cortex.paloaltonetworks.com/p/XDR), as well as by [Cloud-Delivered Security Services](https://docs.paloaltonetworks.com/cdss) for the [Next-Generation Firewall](https://docs.paloaltonetworks.com/ngfw) such as [WildFire](https://docs.paloaltonetworks.com/wildfire) and [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering). In particular, the Cortex XDR anti-ransomware module included out-of-the-box protections that prevented adverse behavior from the ransomware samples we tested without the need for specific detection logic or signatures. The [Prisma Cloud](https://docs.paloaltonetworks.com/prisma/prisma-cloud) Defender should be deployed on cloud-based Windows virtual machines to ensure they are protected. [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) is able to provide visibility that can prove valuable for proactive protection. The [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html) can also be engaged to help with a compromise or to provide a proactive assessment to lower your risk. | **Related Unit 42 Topics** | [**Ransomware**](https://unit42.paloaltonetworks.com/category/ransomware/), **[Cybercrime](https://unit42.paloaltonetworks.com/category/cybercrime/)** | |----------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------| ## BianLian Threat Overview The BianLian group has been extremely active ever since it [emerged in 2022](https://redacted.com/blog/bianlian-ransomware-gang-gives-it-a-go/), with new organizations compromised by the group being reported on their leak site almost on a weekly basis. Figure 1 below details their activity throughout 2023, as illustrated by their leak site data. ![Image 1 is a graph of BianLian group activity from January to December 2023. The sharpest spike occurs in May and then falls with the lowest point in August. It then starts to climb upward again.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/01/chart-2.png) Figure 1. Activity of the BianLian group throughout 2023. This group impacts mainly the healthcare, manufacturing, professional and legal services sectors. Their attacks have primarily taken place in North America, but they were also seen in the EU and India. [BianLian](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-136a) shares a small custom .NET tool with the [Makop](https://medium.com/@lcam/makop-the-toolkit-of-a-criminal-gang-53cd44563c11) ransomware group, which indicates a possible connection between the two groups. BianLian has moved from a double extortion scheme of encrypting their victims' assets, stealing data, and threatening to publish it if they do not pay the ransom to a main focus of [extortion](https://redacted.com/blog/bianlian-ransomware-gang-continues-to-evolve/) without encryption. The group's leak site indicates that BianLian might be expanding by hiring new developers and affiliates, as noted in the "Work with us" section from the group's homepage shown below in Figure 2. ![Image 2 is a screenshot of the BianLian leak site homepage as of December 2023. BianLian. Categories are Home, Companies, Tags, Contacts. Work with us: targets’ providers, software engineers, pentesters, journalists. Tox: \[redacted\]. Email: \[redacted onion email\]. Most of the following text is also redacted.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/01/word-image-132125-2.png) Figure 2. The BianLian leak site homepage, late December 2023. The BianLian group regularly updates the list of compromised targets on their leak site. Figure 3 details the most affected countries. While BianLian has impacted organizations all over the world, the US is clearly the most affected country as of 2023. ![Image 3 is a heat map of countries impacted by BianLian over 2023. The highest affected country is North America followed by parts of the EU and India.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/01/chart-3.png) Figure 3. A map showing the countries impacted by BianLian in 2023. As detailed in Figure 4 below, healthcare is the sector most affected by the BianLian group, with manufacturing a close second. In January 2023, the group claimed to have [exfiltrated 1.7 TB of data](https://thecyberexpress.com/bianlian-ransomware-st-rose-hospital-as-victim/), including personal data of patients and employees, from a California-based hospital. Attacks on healthcare organizations are especially concerning because they disrupt hospitals' day-to-day operations and potentially endanger patients' lives. ![Image 4 is a column graph of all of the industries attacked by BianLian in 2023. The most-attacked sectors are healthcare, manufacturing and professional and legal services.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/01/chart-4.png) Figure 4. The distribution of the sectors that BianLian attacked in 2023. ## Possible Connection to Makop Ransomware During our analysis, we noticed a [small .NET custom executable](https://www.virustotal.com/gui/file/40126ae71b857dd22db39611c25d3d5dd0e60316b72830e930fba9baf23973ce) was shared between the [BianLian](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-136a) and [Makop](https://medium.com/@lcam/makop-the-toolkit-of-a-criminal-gang-53cd44563c11) ransomware groups. Both groups also used the same hash of the publicly available Advanced Port Scanner tool. This .NET tool is responsible for retrieving file enumeration, registry and clipboard data. This tool contains some words in the Russian language, such as the numbers one to four. The use of such a tool indicates that the two groups might have shared a tool set or used the services of the same developers in the past. A possible -- yet not confirmed -- explanation for this overlap is that BianLian could be sharing a codebase with the Makop group, or using the services of the same third-party developers. This phenomenon is well-known and documented among certain underground cybercrime groups. Another noteworthy fact is that the Makop ransomware was documented [excluding certain file extensions](https://www.lifars.com/knowledge-center/makop-ransomware/) when encrypting an infected endpoint, including known extensions that are used by other ransomware strains. This is yet another indicator of possible existing relationships among these threat actors, or at least a "not stepping on someone's toes" approach when it involves other ransomware groups. ## Technical Analysis ### Attack Lifecycle We have mapped the attack stages that are common with the BianLian group to the MITRE ATT\&CK framework, which is summarized below. #### Initial Access To infiltrate corporate networks, BianLian operators often perform the following activities: * Use stolen Remote Desktop Protocol (RDP) credentials * Exploit the ProxyShell vulnerability * Target virtual private network (VPN) providers * Use other [previously reported](https://redacted.com/blog/bianlian-ransomware-gang-gives-it-a-go/) techniques such as deploying web shells During the last year, BianLian's methods of infiltration and lateral movement [did not change much](https://redacted.com/blog/bianlian-ransomware-gang-continues-to-evolve/). Nevertheless, we were able to retrieve interesting forensic data from our telemetry that provides additional behavioral indicators of compromise (IoCs). After successfully infiltrating an organization's network, our telemetry indicates the BianLian group uses various public tools to move laterally, dump credentials and remotely execute a backdoor payload. #### Credential Dumping In our telemetry, we have witnessed dumping of the Security Accounts Manager (SAM) registry hive into a file at %windir%\\Temp. This is a [common technique](https://attack.mitre.org/techniques/T1003/002/) used by attackers. The SAM stores hashed passwords from accounts used on the attacked machine, and it can be recovered when processing SYSTEM privileges. The corresponding Cortex XDR alert is shown in Figure 5. ![Image 5 is a screenshot of an alert in Cortex XDR. The categories are Severity, which is high, the alert source, action, category, alert name and description.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/01/word-image-132125-5.png) Figure 5. SAM dumping alert in Cortex XDR. #### Persistence During the analysis of our telemetry, we saw the attackers drop the BianLian backdoor DLL component under the following path: * c:\\\\programdata\\\\vmware\\\\\[filename\].dll. To execute the backdoor, they used the [impacket](https://github.com/fortra/impacket) tool to create the following scheduled task: cmd.exe /C rundll32.exe c:\\\\programdata\\\\vmware\\\\\[filename\].dll,Entry \> C:\\\\Windows\\\\Temp\\\\\[filename\].tmp 2\>\&1. |-------|------------------------------------------------------------------------------------------------------------------------------------| | 1 2 3 | cmd.exe /C rundll32.exe c:\\\\programdata\\\\vmware\\\\\[filename\].dll,Entry \> C:\\\\Windows\\\\Temp\\\\\[filename\].tmp 2\>\&1. | The creation of the task was detected by Cortex XDR, and the corresponding alert is shown in Figure 6 below. ![Image 6 is a screenshot of an alert in Cortex XDR. The categories are Severity, which is high, the alert source, action, category, alert name and description.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/01/word-image-132125-6.png) Figure 6. The impacket task creation alert in Cortex XDR. This task's role is to periodically execute the backdoor DLL with its export function named Entry, using rundll32. The execution of the backdoor DLL was detected and prevented by Cortex XDR. The alert and prevention pop-up are shown in Figures 7 and 8, respectively. ![Image 7 is a screenshot of an alert in Cortex XDR. The categories are Severity, which is medium, the alert source, action, category, alert name and description.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/01/word-image-132125-7.png) Figure 7. The backdoor execution detection by Cortex XDR in detect mode. ![Image 8 is a screenshot of the Cortex XDR Prevention Alert window. Cortex XDR has blocked a malicious activity! Application name: Windows host process. Application publisher: Microsoft Corporation. File origin: Hard drive on this computer.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/01/word-image-132125-8.png) Figure 8. The backdoor execution prevention by Cortex XDR in prevent mode. The backdoors themselves have different names and paths in each incident, thus making it difficult to implement naming-based behavioral detection. #### Reconnaissance To get a better picture of an already infected network's open ports that attackers can later use for lateral movement, the tool [Advanced Port Scanner](https://www.virustotal.com/gui/file/d0c1662ce239e4d288048c0e3324ec52962f6ddda77da0cb7af9c1d9c2f1e2eb) by Famatech was used from the following path: * C:\\\\Users\\\\%username%\\\\AppData\\\\Local\\\\Temp\\\\31\\\\Advanced\_Port\_Scanner\_2.5.3869.exe This is the same Advanced Port Scanner file that Makop ransomware was [previously documented](https://medium.com/@lcam/makop-the-toolkit-of-a-criminal-gang-53cd44563c11) using. The alerts raised by its execution are shown in Figure 9. ![Image 9 is a screenshot of an alert in Cortex XDR. The categories are Severity, which is Informational (two instances) and medium (one instance), the alert source, action, category, and alert name.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/01/word-image-132125-9.png) Figure 9. Alerts raised by the execution of Advanced Port Scanner. #### Encryptor and Backdoor Since the beginning of their activity, BianLian used two main components for their final payloads: an encryptor and a [backdoor](https://redacted.com/blog/bianlian-ransomware-gang-gives-it-a-go/). Figure 10 below shows the encryptor's ransom note. ![Image 10 is a screenshot of a BianLian ransomware note. Title: Look at this instruction.txt. Your network systems were attacked and encrypted. Contact us in order to restore your date. Don’t make any changes in your file structure: touch no files, don’t try to recover by yourself, that may lead to its complete loss. To contact us you have to download “tox” messenger. Add user with the following ID to get your instructions \[redacted\]. Alternative way \[redacted email\]. Your ID: \[redacted\]. You should know that we have been downloading data rom your network for a significant time before the attack: financial, client, business, post, technical and personal files. In 10 days it will be posted at our site. \[redacted\] with links. Send to your clients, partners, competitors and news agencies, that will lead to a negative impact on your company: potential financial, business and reputational loses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/01/word-image-132125-10.png) Figure 10. Example of a ransom note generated by a BianLian encryptor first seen in April 2023. In early 2023, Avast released a [decryptor for BianLian's encryptor](https://decoded.avast.io/threatresearch/decrypted-bianlian-ransomware/), which ultimately caused the group to cease most of its encryption activity. The threat actors then shifted their operation into a steal-and-extort scheme, mainly relying on their custom backdoor. [BianLian's backdoor](https://redacted.com/blog/bianlian-ransomware-gang-gives-it-a-go/), similar to the encryptor, is written in Go. Its core functionality is more of a loader than a classic backdoor, with its main functionality being downloading and executing additional payloads. The backdoor contains a hard-coded C2 IP address and port to communicate with. As shown in Figures 11 and 12, Cortex XDR successfully detected the execution of the encryptor, using its anti-ransomware module and other behavioral and static detection signatures. ![Image 11 is a screenshot of an alert in Cortex XDR.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/01/word-image-132125-11.png) Figure 11. BianLian encryptor detection by Cortex XDR in detect mode. ![Image 12 is a screenshot of alerts in Cortex XDR. They were initiated by bianlian\_encryptor.exe.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/01/word-image-132125-12.png) Figure 12. Alerts raised by Cortex XDR detecting the BianLian encryptor in detect mode. As shown in Figure 13, when operating in prevent mode, the BianLian encryptor is prevented by Cortex XDR. ![Image 13 is a screenshot of the Cortex XDR Prevention Alert window. Cortex XDR has blocked a malicious activity! Application name: bianlian\_encrypotr.exe. Application publisher: Unknown](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/01/word-image-132125-13.png) Figure 13. The BianLian encryptor is prevented by Cortex XDR in prevent mode. Figures 14 and 15 below demonstrate how Cortex XDR also detected the BianLian custom backdoor in detect mode and prevented it in prevent mode. ![Image 14 is a screenshot of an alert in Cortex XDR.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/01/word-image-132125-14.jpeg) Figure 14. Cortex XDR detecting the BianLian backdoor in detect mode. ![Image 15 is a screenshot of the Cortex XDR Prevention Alert window. Cortex XDR has blocked a malicious activity! Application name: bianlian\_encrypotr.exe. Application publisher: Unknown.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/01/word-image-132125-15.png) Figure 15. The BianLian backdoor is prevented by Cortex XDR in prevent mode. ## Conclusion Following its discovery in 2022, the BianLian group has been one of the most active and prevalent extortion groups in the cyberthreat landscape. Out of the leak site data tracked by Unit 42 between January and mid-December of 2023, BianLian was in the top 10 of the most active groups. There is a growing list of alleged victims that they update on their leak site. Maintaining their tactics, techniques and procedures (TTPs) of infiltrating corporate networks, the BianLian group has shown adaptiveness to the ransomware market demands. They have shifted from double-extortion into being focused solely on extortion efforts, pressuring their victims into paying the ransom without encrypting their files. A possible connection to the Makop ransomware group was also found, due to their mutual use of a custom tool. ## Protections and Mitigations [SmartScore](https://www.paloaltonetworks.com/blog/security-operations/beating-alert-fatigue-with-cortex-xdr-smartscore-technology/), a unique ML-driven scoring engine that translates security investigation methods and their associated data into a hybrid scoring system, scored an incident involving BianLian backdoor at 91 out of 100, as shown in Figure 16. This type of scoring helps analysts determine which incidents are more urgent and provides context about the reason for the assessment, assisting with prioritization. ![Image 16 is a screenshot of SmartScore information scored at 91. It includes why the score was set and also insights.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/01/word-image-132125-16.png) Figure 16. SmartScore information about a BianLian backdoor incident. Palo Alto Networks customers are better protected from the BianLian encryptor and backdoor components. The Cortex XDR and XSIAM platforms detect and prevent the execution flow described in the screenshots included in the previous section. The Cortex XDR agent included out of the box protections that prevented adverse behavior from the samples we tested from this group, without the need for specific detection logic or signatures. [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?_gl=1*13pmp8e*_ga*NzQyNjM2NzkuMTY2NjY3OTczNw..*_ga_KS2MELEEFC*MTY2OTczNjA2MS4zMS4wLjE2Njk3MzYwNjEuNjAuMC4w) and XSIAM detect user- and credential-based threats by analyzing user activity from multiple data sources including the following: * Endpoints * Network firewalls * Active Directory * Identity and access management solutions * Cloud workloads Cortex XDR and XSIAM build behavioral profiles of user activity over time with machine learning. By comparing new activity to past activity, peer activity and the expected behavior of the entity, Cortex XDR and XSIAM detect anomalous activity indicative of credential-based attacks. They also offer the following protections related to the attacks discussed in this post: * Prevent the execution of known malicious malware * Prevent execution of unknown malware using [Behavioral Threat Protection and](https://www.paloaltonetworks.com/products/secure-the-network/subscriptions/threat-prevention?_gl=1*13pmp8e*_ga*NzQyNjM2NzkuMTY2NjY3OTczNw..*_ga_KS2MELEEFC*MTY2OTczNjA2MS4zMS4wLjE2Njk3MzYwNjEuNjAuMC4w) machine learning based on the Local Analysis module * Protect against credential-gathering tools and techniques using the Credential Gathering Protection, available from Cortex XDR 3.4 * Protect against exploitation of different vulnerabilities including ProxyShell using the Anti-Exploitation modules as well as Behavioral Threat Protection Cortex XDR Pro detects post-exploitation activity, including credential-based attacks, with [behavioral analytics](https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-analytics-alert-reference/cortex-xdr-analytics-alert-reference/analytics-alerts-by-required-data-source). The [Prisma Cloud](https://docs.paloaltonetworks.com/prisma/prisma-cloud) Defender as well as Cortex XDR for cloud agents should be deployed on cloud-based Windows virtual machines to ensure they are protected from these known malicious binaries. [WildFire](https://docs.paloaltonetworks.com/wildfire) signatures can be used by both Palo Alto Networks cloud services to ensure cloud-based Windows virtual machine runtime operations are being analyzed and those resources are protected. [Cloud-Delivered Security Services](https://docs.paloaltonetworks.com/cdss) for the [Next-Generation Firewall](https://docs.paloaltonetworks.com/ngfw) such as [WildFire](https://docs.paloaltonetworks.com/wildfire) and [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) include protections based on the IoCs shared in this article. [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) is also able to detect exposed RDP and many other remote access interfaces which are often brute forced or exploited with compromised credentials. This visibility can prove valuable through proactive prevention. ![Image 17 is a screenshot of Cortex Xpanse Attack Surface rules. It includes the following categories: Status. Severity, Rule Name, Description, Remediation Guidance and more.](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/01/word-image-132125-17.png) Figure 17. A subset of the exposed remote access interface types that Cortex Xpanse can detect. If you think you might have been impacted or have an urgent matter, get in touch with the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html?_gl=1*13pmp8e*_ga*NzQyNjM2NzkuMTY2NjY3OTczNw..*_ga_KS2MELEEFC*MTY2OTczNjA2MS4zMS4wLjE2Njk3MzYwNjEuNjAuMC4w) or call: * North America Toll-Free: 866.486.4842 (866.4.UNIT42) * EMEA: +31.20.299.3130 * APAC: +65.6983.8730 * Japan: +81.50.1790.0200 Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the [Cyber Threat Alliance](https://www.cyberthreatalliance.org). ## Indicators of Compromise ### Examples of the BianLian Encryptor * af46356eb70f0fbb0799f8a8d5c0f7513d2f6ade4f16d4869f2690029b511d4f * 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e * 3a2f6e614ff030804aa18cb03fcc3bc357f6226786efb4a734cbe2a3a1984b6f * 46d340eaf6b78207e24b6011422f1a5b4a566e493d72365c6a1cace11c36b28b * 1fd07b8d1728e416f897bef4f1471126f9b18ef108eb952f4b75050da22e8e43 * eaf5e26c5e73f3db82cd07ea45e4d244ccb3ec3397ab5263a1a74add7bbcb6e2 ### Examples of the BianLian Backdoor * c775e6d87a3bcc5e94cd055fee859bdb6350af033114fe8588d2d4d4f6d2a3ae * c57ca631b069745027d0b4f4d717821ca9bd095e28de2eafe4723eeaf4b062cf * c592194cea0acf3d3e181d2ba3108f0f86d74bcd8e49457981423f5f902d054b * df51b7b031ecc7c7fa899e17cce98b005576a20a199be670569d5e408d21048c * 2ed448721f4e92c7970972f029290ee6269689c840a922982ac2f39c9a6a838f * 264af7e7aa17422eb4299df640c1aa199b4778509697b6b296efa5ae7e957b40 * 73d095abf2f31358c8b1fb0d5a0dc9807e88d44282c896b5033c1b270d44111f * 8b65c9437445e9bcb8164d8557ecb9e3585c8bebf37099a3ec1437884efbdd24 * 4ca84be5b6ab91694a0f81350cefe8379efcad692872a383671ce4209295edc7 * 93fb7f0c2cf10fb5885e03c737ee8508816c1102e9e3d358160b78e91fa1ebdb * afb7f11da27439a2e223e6b651f96eb16a7e35b34918e501886d25439015bf78 * 53095e2ad802072e97dbb8a7ccea03a36d1536fce921c80a7a2f160c83366999 * 16cbfd155fb44c6fd0f9375376f62a90ac09f8b7689c1afb5b9b4d3e76e28bdf * 60b1394f3afee27701e2008f46d766ef466caa7711c45ddfd443a71efc39a407 * ba3c4bc99b67038b42b75a206d7ef04f6d8abaf87a76c373d4dec85e73859ce2 * e7e097723d00f58eab785baf30365c1495e99aa6ead6fe1b86109558838d294e * 96e02ea8b1c508f1ee3c1535547f9b89396f557011e61478644ae5876cdaaca5 * ac1d42360c45e0e908d07e784ceb15faf8987e4ba1744d56313de6524d2687f7 * 1cba58f73221b5bb7930bfeab0106ae5415e70f49a595727022dcf6fda1126e9 * 487f0d748a13570a46b20b6687eb7b7fc70a1a55e676fb5ff2599096a1ca888c * f84edc07b23423f2c2cad47c0600133cab3cf2bd6072ad45649d6faf3b70ec30 * 93953eef3fe8405d563560dc332135bfe5874ddeb373d714862f72ee62bef518 * f3f3c692f728b9c8fd2e1c090b60223ac6c6e88bf186c98ed9842408b78b9f3c * f6669de3baa1bca649afa55a14e30279026e59a033522877b70b74bfc000e276 * 228ef7e0a080de70652e3e0d1eab44f92f6280494c6ba98455111053701d3759 * 0e4246409cdad59e57c159c7cc4d75319edf7d197bc010174c76fe1257c3a68e * 90f50d723bf38a267f5196e22ba22584a1c84d719b501237f43d10117d972843 * 4c008ac5c07d1573a98eb87bffe64e9c9e946de63b40df3f686881cf0698eef7 * d3574cc69a5974a32a041d1dc460861fe1cef3c1f063171c5fc890ca0e8403c4 * 99fc3e13f3b4d8debf1f2328f56f3810480ee2eed9271ebf413c0015c0a54c23 * 4f4a2adc7ecc41f12defe864c78ad6bbf708355affac4115dcd5065b38198109 * 188e95d6ed0810c216ab0043ecc2f54f514e624ca31ed1eec58cfc18cc9ac75e * 16b0f643670d1f94663179815bfac493f5f30a61d15c18c8b305b1016eece7ef * c5fa6a7a3b48a2a4bbcbbbb1ca50c730f3545e3fbb03fa17fb814ad7a400a21f * d3fc56b98af9748f7b6dd44e389d343781ff47db9ed3d92ae8fadc837f25f6ed * 23295c518f194dee7815728de15bafe07bf53b52d987c7ad2b2050f833f770f7 * 06f10c935fae531e070c55bde15ee3b48b6bb289af237e96eec82124c19d1049 * 7ba40902dc495d8da28d0c0788bcfb1449818342df89f005af8ce09f2ee01798 * 3106e313f6df73b84acd8d848b467ac42c469ffabbad19e4fdcc963639cfff8c * 56e63edb832fdf08d19ecfe2de1c7c6c6581cedd431215ded0c8e44ac9aed925 * 195c11ee41f5a80d8e1b1881245545d6529671b926eb67bd3186e3ffecefe362 * ac14946fd31ca586368c774f3a3eed1620bf0f0b4f54544f5d25e87facf18d82 * 29a14cb63a1900fe185fad1c1b2f2efb85a058ac3c185948b758f3ce4107e11e * 91ffe0ee445b82bd3360156feeecf8112d27c9333f9796caffcfda986fd7e9b4 * 5162fd73cbe8f313d2b0e4180bab4cbe47185f73a3ffc3d1dcccc36bc2865142 * 7dabe5d40c13c7c342b7182eaf7c63fbb5e326300316f6f6518b527d57e79ac8 * 4e92b73a17e0646876fb9be09c4ee6f015f00273932d2422b69339e22b78b385 * 9413ba4a33ea77326b837ba538f92348e1909d5263ca67a86aa327daa8fbba30 * bd41ac2686beadc1cb008433960317b648caae37c93d8c0d61ad40fe27b5b67e * bd57af28c94c3b7f156511c48f4b62cd1b4c29a1a693f4dc831e0a928691cc56 ### Advanced Port Scanner * d0c1662ce239e4d288048c0e3324ec52962f6ddda77da0cb7af9c1d9c2f1e2eb ### .NET Tool * 40126ae71b857dd22db39611c25d3d5dd0e60316b72830e930fba9baf23973ce ### BianLian Command and Control Servers * 208\.123.119\[.\]123 * 13\.215.228\[.\]73 * 54\.193.91\[.\]232 * 172\.96.137\[.\]159 * 204\.152.203\[.\]90 * 144\.208.127\[.\]119 * 192\.161.48\[.\]43 * 146\.70.87\[.\]197 * 45\.86.230\[.\]64 * 45\.56.165\[.\]17 * 23\.163.0\[.\]168 * 172\.96.137\[.\]249 * 173\.254.204\[.\]78 * 185\.56.137\[.\]117 * 52\.87.206\[.\]242 * 45\.66.249\[.\]118 * 96\.44.157\[.\]203 * 103\.20.235\[.\]122 * 44\.212.9\[.\]14 * 149\.154.158\[.\]154 * 146\.59.102\[.\]74 * 96\.44.135\[.\]76 * 85\.239.52\[.\]96 * 66\.85.156\[.\]83 * 198\.252.98\[.\]186 * 3\.236.161\[.\]7 * 13\.59.168\[.\]154 * 172\.245.128\[.\]35 * 216\.146.25\[.\]60 * 172\.86.122\[.\]183 * 185\.99.133\[.\]112 * 149\.154.158\[.\]214 * 104\.200.72\[.\]6 * 23\.163.0\[.\]228 ## Additional Resources * [BianLian ransomware gang holds Save the Children hostage](https://www.computerweekly.com/news/366552075/BianLian-ransomware-gang-holds-Save-the-Children-hostage) -- Computer Weekly, by TechTarget * [#StopRansomware: BianLian Ransomware Group](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-136a) -- U.S. Cybersecurity and Infrastructure Security Agency (CISA) * [BianLian Ransomware Gang Gives It a Go!](https://redacted.com/blog/bianlian-ransomware-gang-gives-it-a-go/) -- Redacted * [BianLian Ransomware Gang Continues to Evolve](https://redacted.com/blog/bianlian-ransomware-gang-continues-to-evolve/) -- Redacted * [Makop: The Toolkit of a Criminal Gang](https://medium.com/@lcam/makop-the-toolkit-of-a-criminal-gang-53cd44563c11) -- L M, Medium * [Makop Ransomware Whitepaper](https://www.lifars.com/knowledge-center/makop-ransomware/) -- LIFARS by SecurityScorecard * [BianLian Ransomware Lists St Rose Hospital as Victim](https://thecyberexpress.com/bianlian-ransomware-st-rose-hospital-as-victim/) -- The Cyber Express * [Decrypted: BianLian Ransomware](https://decoded.avast.io/threatresearch/decrypted-bianlian-ransomware/) -- Avast Threat Labs * [OS Credential Dumping: Security Account Manager, Sub-technique T1003.002 - Enterprise](https://attack.mitre.org/techniques/T1003/002/) -- MITRE ATT\&CK Back to top ### Tags * [BianLian](https://unit42.paloaltonetworks.com/tag/bianlian/ "BianLian") * [Bitter Scorpius](https://unit42.paloaltonetworks.com/tag/bitter-scorpius/ "Bitter Scorpius") * [Makop](https://unit42.paloaltonetworks.com/tag/makop/ "Makop") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Parrot TDS: A Persistent and Evolving Malware Campaign](https://unit42.paloaltonetworks.com/parrot-tds-javascript-evolution-analysis/ "Parrot TDS: A Persistent and Evolving Malware Campaign") ### Table of Contents * ### Related Articles * [Threat Actor Groups Tracked by Palo Alto Networks Unit 42 (Updated Aug. 1, 2025)](https://unit42.paloaltonetworks.com/threat-actor-groups-tracked-by-palo-alto-networks-unit-42/ "article - table of contents") * [Extortion and Ransomware Trends January-March 2025](https://unit42.paloaltonetworks.com/2025-ransomware-extortion-trends/ "article - table of contents") * [Beware of BadPack: One Weird Trick Being Used Against Android Devices](https://unit42.paloaltonetworks.com/apk-badpack-malware-tampered-headers/ "article - table of contents") ## Related Resources ![Pictorial representation of Russian global webmail espionage campaign. A digital illustration of a world map in a network style, highlighting continents with glowing lines and connectivity points in a red and blue theme.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/07/06_Nation-State-cyberattacks_1920x900-1-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) July 23, 2026 [#### Russian Global Webmail Espionage](https://unit42.paloaltonetworks.com/russian-webmail-espionage/) * [CL-STA-1114](https://unit42.paloaltonetworks.com/tag/cl-sta-1114/ "CL-STA-1114") * [JavaScript](https://unit42.paloaltonetworks.com/tag/javascript/ "JavaScript") * [Javascript injection](https://unit42.paloaltonetworks.com/tag/javascript-injection/ "javascript injection") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/russian-webmail-espionage/ "Russian Global Webmail Espionage") ![Pictorial representation of a woman standing in a server room holding a laptop that projects a digital code overlay.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/05/06_Security-Technology_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) May 28, 2026 [#### 2026 World Cup: Discussing The World's Biggest Game's Attack Surface](https://unit42.paloaltonetworks.com/fifa-world-cup-attack-surface/) * [Fiddling Scorpius](https://unit42.paloaltonetworks.com/tag/fiddling-scorpius/ "Fiddling Scorpius") * [Fighting Ursa](https://unit42.paloaltonetworks.com/tag/fighting-ursa/ "Fighting Ursa") * [Muddled Libra](https://unit42.paloaltonetworks.com/tag/muddled-libra/ "Muddled Libra") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/fifa-world-cup-attack-surface/ "2026 World Cup: Discussing The World’s Biggest Game’s Attack Surface") ![Pictoral representation of a man holding a cellphone with a bokeh skyline in the background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/05/05_Listicle_Category_1505x922-718x440.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) May 27, 2026 [#### Out of the Crypt: The Evolving Cyber Extortion Economy](https://unit42.paloaltonetworks.com/cyber-extortion-economy/) * [Bling Libra](https://unit42.paloaltonetworks.com/tag/bling-libra/ "Bling Libra") * [Extortion](https://unit42.paloaltonetworks.com/tag/extortion/ "Extortion") * [Frontier AI](https://unit42.paloaltonetworks.com/tag/frontier-ai/ "Frontier AI") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/cyber-extortion-economy/ "Out of the Crypt: The Evolving Cyber Extortion Economy") ![Pictorial representation of Iran cyber attacks. Close-up of a person wearing glasses, with computer code reflected in the lenses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/12_Security-Technology_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) April 17, 2026 [#### Threat Brief: Escalation of Cyber Risk Related to Iran (Updated April 17)](https://unit42.paloaltonetworks.com/iranian-cyberattacks-2026/) * [APK](https://unit42.paloaltonetworks.com/tag/apk/ "APK") * [DDoS attacks](https://unit42.paloaltonetworks.com/tag/ddos-attacks/ "DDoS attacks") * [GenAI](https://unit42.paloaltonetworks.com/tag/genai/ "GenAI") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/iranian-cyberattacks-2026/ "Threat Brief: Escalation of Cyber Risk Related to Iran (Updated April 17)") ![Pictorial representation of the APT Boggy Serpens. An illustrated blue snake is highlighted by a red circle against a night sky. The constellation serpens.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/Boggy-Serpens-1920x900-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) March 16, 2026 [#### Boggy Serpens Threat Assessment](https://unit42.paloaltonetworks.com/boggy-serpens-threat-assessment/) * [Advanced Persistent Threat](https://unit42.paloaltonetworks.com/tag/advanced-persistent-threat/ "Advanced Persistent Threat") * [Boggy Serpens](https://unit42.paloaltonetworks.com/tag/boggy-serpens/ "Boggy Serpens") * [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/boggy-serpens-threat-assessment/ "Boggy Serpens Threat Assessment") ![Pictorial representation of Muddled Libra, aka Scattered Spider. A vibrant illustration of the Libra zodiac sign, featuring a stylized balance scale overlaid with a prominent Libra symbol. The background is a starry night sky with shades of purple and blue, suggesting a cosmic theme.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/02/03-1-Muddle-Libra-1920x900-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/threat-actor-groups.svg)Threat Actor Groups](https://unit42.paloaltonetworks.com/category/threat-actor-groups/) February 10, 2026 [#### A Peek Into Muddled Libra's Operational Playbook](https://unit42.paloaltonetworks.com/muddled-libra-ops-playbook/) * [Muddled Libra](https://unit42.paloaltonetworks.com/tag/muddled-libra/ "Muddled Libra") * [PowerShell](https://unit42.paloaltonetworks.com/tag/powershell/ "PowerShell") * [Scattered Spider](https://unit42.paloaltonetworks.com/tag/scattered-spider/ "Scattered Spider") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/muddled-libra-ops-playbook/ "A Peek Into Muddled Libra’s Operational Playbook") ![Pictorial representation of a group of individuals discussing an idea with a whiteboard.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/02/02_Listicle_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) February 3, 2026 [#### Why Smart People Fall For Phishing Attacks](https://unit42.paloaltonetworks.com/psychology-of-phishing/) * [AI](https://unit42.paloaltonetworks.com/tag/ai/ "AI") * [Phishing](https://unit42.paloaltonetworks.com/tag/phishing/ "phishing") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/psychology-of-phishing/ "Why Smart People Fall For Phishing Attacks") ![Pictorial representation of threat groups from Russia. The silhouette of a bear and the Ursa constellation inside an orange abstract planet. Abstract, stylized cosmic setting with vibrant blue and purple shapes, representing space and distant planetary bodies.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/01/Ursa-Russia-B-1920x900-1-786x368.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) January 29, 2026 [#### Understanding the Russian Cyberthreat to the 2026 Winter Olympics](https://unit42.paloaltonetworks.com/russian-cyberthreat-2026-winter-olympics/) * [AI](https://unit42.paloaltonetworks.com/tag/ai/ "AI") * [IoT](https://unit42.paloaltonetworks.com/tag/iot/ "IoT") * [Russia](https://unit42.paloaltonetworks.com/tag/russia/ "Russia") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/russian-cyberthreat-2026-winter-olympics/ "Understanding the Russian Cyberthreat to the 2026 Winter Olympics") ![Pictorial representation of RaaS RansomHouse. Digital representation of cybersecurity concept with a padlock superimposed over computer circuit boards, symbolizing data protection and encryption technologies.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/12/06_Ransomware_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) December 17, 2025 [#### From Linear to Complex: An Upgrade in RansomHouse Encryption](https://unit42.paloaltonetworks.com/ransomhouse-encryption-upgrade/) * [ESXi](https://unit42.paloaltonetworks.com/tag/esxi/ "ESXi") * [Jolly Scorpius](https://unit42.paloaltonetworks.com/tag/jolly-scorpius/ "Jolly Scorpius") * [RansomHouse](https://unit42.paloaltonetworks.com/tag/ransomhouse/ "RansomHouse") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ransomhouse-encryption-upgrade/ "From Linear to Complex: An Upgrade in RansomHouse Encryption") ![Pictorial representation of 01flip ransomware written in Rust. Digital artwork of a pixelated U.S. dollar bill disintegrating into small blocks against a blue data matrix background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/12/05_Ransomware_Category_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) December 10, 2025 [#### 01flip: Multi-Platform Ransomware Written in Rust](https://unit42.paloaltonetworks.com/new-ransomware-01flip-written-in-rust/) * [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin") * [CL-CRI-103](https://unit42.paloaltonetworks.com/tag/cl-cri-103/ "CL-CRI-103") * [Cryptocurrency](https://unit42.paloaltonetworks.com/tag/cryptocurrency/ "Cryptocurrency") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/new-ransomware-01flip-written-in-rust/ "01flip: Multi-Platform Ransomware Written in Rust") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)