Ransomware Hits Law Firm: BianLian Targets Fish Nelson & Holden
Incident Date:
August 28, 2024
Overview
Title
Ransomware Hits Law Firm: BianLian Targets Fish Nelson & Holden
Victim
Fish Nelson & Holden
Attacker
Bianlian
Location
First Reported
August 28, 2024
Ransomware Attack on Fish Nelson & Holden by BianLian Group
Fish Nelson & Holden, a Birmingham, Alabama-based law firm specializing in insurance defense litigation, has become the latest victim of a ransomware attack orchestrated by the notorious BianLian group. The firm, known for its expertise in defending premises liability, products liability, personal injury, property loss, workers' compensation, and employment law cases, primarily serves insurance carriers and self-insured employers.
Company Profile and Industry Standing
Established in 2007, Fish Nelson & Holden operates as a Limited Liability Company (LLC) and employs a small team of six attorneys. Despite its modest size, the firm has garnered recognition for its personalized client service and has received accolades such as "Top 40 under 40" and "Best of the Bar." The firm's annual revenue ranges from $1 million to $5 million, reflecting its focused practice in a niche area of law.
Attack Overview
The BianLian ransomware group has claimed responsibility for the attack, which resulted in the compromise of 1TB of sensitive data. The stolen data includes medical and lab test files of clients, accounting and financial records, contract data, non-disclosure agreements, accident reports, files from top management's PCs, operational and business documents, as well as email and message archives. This breach poses significant risks to the firm's operations, client confidentiality, and overall business integrity.
About BianLian Ransomware Group
BianLian is a sophisticated ransomware group that has evolved from targeting individual users to launching high-profile attacks on businesses and organizations globally. Initially functioning as a banking trojan, BianLian transitioned into advanced ransomware operations, emphasizing extortion-based strategies. The group is known for its exfiltration-based extortion tactics, threatening victims with financial, business, and legal consequences if payment is not made.
Penetration and Vulnerabilities
BianLian typically gains initial access through compromised Remote Desktop Protocol (RDP) credentials, implanting custom backdoors specific to each victim. The group uses PowerShell and Windows Command Shell for defense evasion and employs various tools for discovery, lateral movement, collection, exfiltration, and impact. The firm's reliance on sensitive client data and its relatively small size may have made it an attractive target for the ransomware group.
Sources
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.