BianLian attacks Advantage Orthopedic & Sports Medicine

Incident Date:

February 15, 2024

World map

Overview

Title

BianLian attacks Advantage Orthopedic & Sports Medicine

Victim

Advantage Orthopedic & Sports Medicine

Attacker

Bianlian

Location

Gresham, USA

Oregon, USA

First Reported

February 15, 2024

Advantage Orthopedic & Sports Medicine Responds to Cyber Attack

On February 11th, Advantage Orthopedic & Sports Medicine was notified of a potential cyber attack by BianLian. Advantage Orthopedic & Sports Medicine is a clinic specializing in orthopedic injuries. The company has an urgent clinic where patients have direct access to an orthopedic specialist. Its entire team is dedicated to getting patients in quickly, diagnosing their injury, and getting them on the road to recovery. The company released a statement saying it took immediate action to secure its data and computer systems. “We utilize a cloud-based internet driven electronic health record for daily operations and records of patients. This was unable to be hacked due to the cloud base. However, they claim to have other data that may include a breach in HIPAA regarding patient information. We are diligently working with our IT department, The FBI, and local law enforcement to rectify this ASAP.”

The Evolution of BianLian

BianLian is not a traditional RaaS. They first emerged in June 2022 as a typical RaaS provider with Golang-based ransomware until a decrypter was released. In early 2023, they appear to have abandoned the ransomware payload portion of attacks in favor of less complicated data exfiltration and extortion attacks. This shows how successful the double extortion strategy is for ransomware groups, and we will likely see more groups join the likes of BianLian (and Karakurt before them).

BianLian leverages open-source tooling and command-line scripts to engage in credential harvesting and data exfiltration. BianLian increased attack volumes as they have moved away from deploying ransomware payloads in favor of pure data extortion attacks, making them one of the more prominent groups in Q1-2023, although still lagging far behind leaders. It is unclear how much BianLian typically requests for a ransom amount or if they are keen to negotiate the demand down.

BianLian successfully attacked several high-profile organizations before a free decryption tool was released to help victims recover files encrypted by ransomware. The group abandoned the RaaS model in favor of pure data extortion attacks where data is exfiltrated and ransom demand issued, but no ransomware is deployed. BianLian has been observed deploying a custom Go-based backdoor for remote access. BianLian uses PowerShell and Windows Command Shell to bypass and evade security solutions. BianLian primarily targets financial institutions, healthcare, manufacturing, education, entertainment, and energy sectors by leveraging compromised Remote Desktop Protocol (RDP) credentials. Almost exclusively a data extortion attack group now, rarely observed deploying ransomware payloads.

Recent Ransomware Attacks

The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.

The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.