Ransomwarehigh
FBI says BianLian based in Russia, moving from ransomware attacks to extortion
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-31207 | Security feature bypass in Microsoft Exchange Server (ProxyShell) enables webshell RCE | 6.6 | 100% | KEVRansomwarePoC | KEV |
CVE-2021-34473+1 related CVE | SSRF (CWE-918) in Microsoft Exchange Server Enabling RCE (ProxyShell) | 9.1 group max | 100% | KEVRansomwarePoC | KEV |
| CVE-2022-37969 | Out-of-bounds write flaw in Microsoft Windows CLFS driver enables privilege escalation | 7.8 | 28% | KEVRansomware | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | onionmail.org | d includes an alternative contact email addresses n0torious@onionmail[.]org and xwikipedia@onionmail[.]org.” The group has also sough |
From the original article
2 min read at therecord.media
BianLian ransomware actors are likely based in Russia and have multiple Russia-based affiliates, according to new information shared by the FBI and Australian law enforcement. BianLian has drawn scrutiny for attacks on charities like Save The Children as well as healthcare firms like Boston Children’s Health Physicians .
therecord.media
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.