BianLian Data Extortion Group's Attack on Akumin

The BianLian data extortion group claimed an attack on Akumin. On December 29, 2023, Akumin filed a notice of data breach with the Attorney General of Massachusetts after discovering that it was the target of a recent ransomware attack. In this notice, Akumin explains that the incident resulted in an unauthorized party being able to access consumers’ sensitive information, which includes their names, contact information, dates of birth, Social Security numbers, driver’s license numbers, state identification numbers, health insurance policy numbers, patient identification numbers, and medical information.

Akumin Inc. is a healthcare services company based out of Plantation, Florida. Akumin provides radiology and oncology services to hospitals, offering fixed-site outpatient diagnostic imaging services through a network of imaging locations, as well as outpatient radiology and oncology services to approximately 1,000 hospitals and health systems in 47 states. Akumin employs more than 3,631 people and generates approximately $743 million in annual revenue.

BianLian's Evolution

BianLian is not a traditional RaaS. They first emerged in June 2022 as a typical RaaS provider with Golang-based ransomware until a decrypter was released. In early 2023, they appear to have abandoned the ransomware payload portion of attacks in favor of less complicated data exfiltration and extortion attacks. This shows how successful the double extortion strategy is for ransomware groups, and we will likely see more groups join the likes of BianLian (and Karakurt before them).

BianLian leverages open-source tooling and command-line scripts to engage in credential harvesting and data exfiltration. BianLian increased attack volumes as they have moved away from deploying ransomware payloads in favor of pure data extortion attacks, making them one of the more prominent groups in Q1-2023, although still lagging far behind leaders. It is unclear how much BianLian typically requests for a ransom amount, or if they are keen to negotiate the demand down.

BianLian successfully attacked several high-profile organizations before a free decryption tool was released to help victims recover files encrypted by ransomware. The group appears to have abandoned the RaaS model in favor of pure data extortion attacks where data is exfiltrated and ransom demand issues, but no ransomware is deployed. BianLian has been observed deploying a custom Go-based backdoor for remote access. BianLian uses PowerShell and Windows Command Shell to bypass and evade security solutions.

Target Sectors

BianLian primarily targets financial institutions, healthcare, manufacturing, education, entertainment, and energy sectors by leveraging compromised Remote Desktop Protocol (RDP) credentials. Almost exclusively a data extortion attack group now, rarely observed deploying ransomware payloads.