Netgroup’s Cybersecurity Observatory noted the publication of a post by the group called “BianLian,” claiming data theft against the Transit Mutual Insurance Corporation of Wisconsin.

Transit Mutual Insurance Corporation is a nonprofit mutual insurance company located in Appleton, Wisconsin. The company provides insurance coverage for public transportation vehicles owned by Wisconsin municipalities. Founded with the goal of supporting the insurance needs of public transportation fleets, Transit Mutual Insurance Corporation plays a crucial role in protecting Wisconsin’s municipal resources.

According to BianLian in their post, the group was reportedly able to obtain about 400 GB of sensitive data belonging to Transit Mutual Insurance Corporation. The compromised data would include corporate information, accounting data, projects, network user folder data, file server data and personal data.

BianLian: a perocolous and sophisticated ransomware

BianLian is a ransomware first discovered in June 2022.
It is written in the open source GoLang programming language and allows threat actors to deploy malware capable of thwarting reverse engineering and compromising multiple platforms.
Here are some of its peculiarities:

• Vulnerability Chain:BianLian exploits the vulnerability chain of ProxyShell in Microsoft Exchange Server (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and SonicWall VPN devices to gain initial access to target networks.Living off the Land (LotL) Methodology:Uses this methodology for lateral displacement and network profiling, making use of tools and resources already present in the compromised system to avoid detection.
• Special backdoor: BianLian uses a special backdoor to maintain constant access to the network and allow retrieval of arbitrary payloads from related remote servers, loading them into memory and executing them.
• Dwell time: The ransomware remains active for six weeks from the time the malicious actor gains initial access until the actual encryption event.
• Encrypted file extension: Adds the .bianlian extension to encrypted files.

The 𝗢𝘀𝘀𝗲𝗿𝘃𝗮𝘁𝗼𝗿𝗶𝗼 𝘀𝘂𝗹𝗹𝗮 𝗖𝘆𝗯𝗲𝗿𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗱𝗶 𝗡𝗲𝘁𝗴𝗿𝗼𝘂𝗽 will continue to monitor the situation and provide updates as more information becomes available.