CYBERSECURITYTRACKER
Incidents

BianLian

Review this actor's tracked leak-site claims, published reporting, and attributed threat evidence.

ransomware521 leak-site claims, all timeLatest observed leak-site post 2025-03-31

Portable threat brief

BianLian

Facts from stored data only; no AI-written text.

Opens the browser print dialog; choose Save as PDF.

Executive facts

Actor
BianLian
Kind
ransomware
Latest observed
2025-03-31
Leak-site claims
521
Catalogued techniques
0

Scope

Tracked sectors
Healthcare, Manufacturing, Business & Professional Services, Legal, Construction & Engineering
Claim records
2022-08-18 to 2025-03-31
News stories naming this group
2026-01-28 to 2026-10-19

Vulnerability events linked to this group

No dated vulnerability events are attached to this group's linked vulnerabilities.

Verified techniques

No verified ATT&CK mapping for this group.

Defensive actions

No defensive actions are attached to this profile.

Ransomware claim data is unverified: RansomLook (CC BY 4.0).

Most-claimed sectorsHealthcareManufacturingBusiness & Professional ServicesLegalConstruction & Engineering
Activity window in this site's data

This is only the dates observed by this site. It is not this actor's lifetime or evidence of dormancy outside these dates.

Claim records
First observed Latest observed
News stories naming this group
First observed Latest observed
Verified ATT&CK phases represented

No verified ATT&CK mapping for this group

Origin and motivation

Origin and motivation not attributed.

No MITRE ATT&CK group mapping exists for this actor yet. Mappings here are strict: an actor links to a MITRE group only when the group's own name, aliases, or MITRE-published description match, and MITRE has not catalogued this group. Technique and defensive action data will appear automatically if a verified mapping lands.

Claims posted under this group's name or leak-site brand
521 on this site
View all on Breaches →
Leak-site claim activity

Claims per month, 2022-08 to 2025-03. Peak 40 in 2023-05.

2022-082025-03
Show monthly counts as a table
MonthClaims
2022-0822
2022-093
2022-109
2022-1116
2022-1224
2023-015
2023-0215
2023-0323
2023-0435
2023-0540
2023-0623
2023-0727
2023-0812
2023-0924
2023-1017
2023-1113
2023-1212
2024-0117
2024-0221
2024-0317
2024-0412
2024-0514
2024-069
2024-0713
2024-0820
2024-0913
2024-109
2024-1113
2024-1211
2025-013
2025-0217
2025-0312

0 additional claims without a disclosure date

News stories naming this group
3 on this site

Ransomware claim data is unverified: RansomLook (CC BY 4.0).

Glossary