BianLian attacks Lutheran Church and Preschool
Incident Date:
September 26, 2023
Overview
Title
BianLian attacks Lutheran Church and Preschool
Victim
Lutheran Church and Preschool
Attacker
Bianlian
Location
First Reported
September 26, 2023
The BianLian Ransomware Gang's Attack on the Lutheran Church and Preschool
The BianLian ransomware gang has attacked the Lutheran Church and Preschool. The Lutheran Church and Preschool is in Oxnard, California, providing religious and educational services to local residents. It was founded in 1948. BianLian posted the Lutheran Church and Preschool on September 26th, claiming to have stolen 200GB of finance, HR, and personal data.
BianLian's Evolution
BianLian is not a traditional RaaS. They first emerged in June 2022 as a typical RaaS provider with Golang-based ransomware until a decrypter was released. In early 2023, they appear to have abandoned the ransomware payload portion of attacks in favor of less complicated data exfiltration and extortion attacks. This shows how successful the double extortion strategy is for ransomware groups, and we will likely see more groups join the likes of BianLian (and Karakurt before them).
Techniques and Strategies
BianLian leverages open-source tooling and command-line scripts to engage in credential harvesting and data exfiltration. BianLian increased attack volumes as they have moved away from deploying ransomware payloads in favor of pure data extortion attacks, making them one of the more prominent groups in Q1-2023, although still lagging far behind leaders.
It is unclear how much BianLian typically requests for a ransom amount, or if they are keen to negotiate the demand down.
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.