New ‘BianLian’ Ransomware Variant on the Rise

Cybercriminals are swarming to deploy an emerging ransomware variant called BianLian that was written in Go, the Google-created open source programming language.

BianLian has been rising popularity since it was first outed in mid-July, according to researchers at Cyble Research Labs, which published details on their study of the ransomware in a blog post last week. Threat actors so far have cast a wide net with the novel BianLian malware, which counts organizations in media and entertainment; manufacturing; education; healthcare; and banking, financial services, and insurance (BFSI) among its victims so far.

Specifically, the media and entertainment sector has taken the brunt of BianLian attacks, with 25% of victims in this industry so far, and 12.5% each in the professional services, manufacturing, healthcare, energy and utilities, and education sectors, according to Cyble.

Attackers using BianLian typically demand unusually high ransoms, and they utilize a unique encryption style that divides the file content into chunks of 10 bytes to evade detection by antivirus products, the researchers said. “First, it reads 10 bytes from the original file, then encrypts the bytes and writes the encrypted data into the target file,” the Cybel researchers wrote in the post.

BianLian’s operators also use double-extortion methods, threatening to leak key stolen data — such as financial, client, business, technical, and personal files — online if ransom demands aren’t met within 10 days. They maintain an onion leak site for this purpose.

How the Ransomware Variant Works

BianLian functions similarly to other ransomware types in that it encrypts files once it infects a targeted system and sends a ransomware note to its victims letting them know how to contact the operators.

Upon execution of the ransomware, BianLian attempts to identify if the file is running in a WINE environment by checking the wine_get_version() function via the GetProcAddress() API, the researchers said. Then, the ransomware creates multiple threads using the CreateThread() API function to perform faster file encryption, which also makes reverse engineering the malware more difficult, they said.

The malware then identifies the…