Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsOrganizations should treat suspected BianLian activity as a potential data-theft incident even if files remain accessible and systems keep running. A joint FBI, CISA, and Australian Signals Directorate Australian Cyber Security Centre (ASD’s ACSC) advisory says the group shifted from stealing and encrypting data to extortion based primarily on stolen data, and its November 2024 update says that shift became exclusive around January 2024.
What the BianLian advisory warns
The agencies describe BianLian as a ransomware developer, deployer, and data-extortion criminal group. The FBI observed it affecting organizations in multiple U.S. critical-infrastructure sectors since June 2022. ASD’s ACSC also observed targeting of Australian critical-infrastructure sectors, as well as professional services and property development. Those observations do not mean every organization or sector faces the same exposure.
The joint advisory was first published May 16, 2023, and updated November 20, 2024. Its update adds tactics, techniques, and procedures drawn from investigations through June 2024 and industry threat intelligence. It is a dated account of observed activity, not confirmation of BianLian’s current infrastructure, targets, or methods.
Does BianLian still encrypt files?
The advisory describes a progression rather than a single, timeless pattern. BianLian initially used double extortion: it stole files and encrypted victims’ systems. Around January 2023, the group shifted primarily to exfiltration-based extortion. The November 2024 update says the group shifted exclusively to exfiltration-based extortion around January 2024.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
The agencies’ earlier observations differed in scope: the 2023 advisory said the FBI observed a primarily exfiltration-based shift, while ASD’s ACSC observed an exclusively exfiltration-based shift. The later update reports the exclusive shift around January 2024. The practical implication is that functioning systems or the absence of encryption do not rule out a serious intrusion or stolen data.
How BianLian may access and move through networks
The advisory reports multiple observed or suspected techniques; it does not say every intrusion uses all of them.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Initial access
- Compromised valid Remote Desktop Protocol (RDP) credentials, potentially sourced through initial-access brokers or phishing.
- Targeting public-facing Windows and ESXi applications, reported in the November 2024 update.
- Possible use of the ProxyShell exploit chain. The agencies describe this as possible, not confirmed.
Credential theft, discovery, and lateral movement
After gaining access, actors have harvested credentials and used Windows tools and downloaded utilities to discover systems and information. They have used legitimate remote-management software, including TeamViewer, Atera Agent, SplashTop, and AnyDesk. For lateral movement, the advisory reports valid accounts over RDP and, in one reported instance, SMB. It also describes custom Go backdoors and possible use of Ngrok or modified Rsocks to proxy network traffic.
Data theft and extortion
The group has exfiltrated data using FTP, Rclone, and Mega. The agencies say its threats to publish stolen information have covered financial, client, business, technical, and personal data unless victims pay.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
What to check if systems still work but data theft is suspected
A lack of obvious disruption is not proof of safety. Check for activity that fits the advisory’s reported methods, while remembering that no single item establishes a BianLian intrusion.
- Unexpected credential access, unusual logins, or unauthorized accounts, particularly accounts with elevated privileges.
- Unapproved remote-access tools or abnormal use of approved tools, including unusual RDP sessions.
- Unusual outbound data transfers or evidence that files were staged before transfer.
- Unexpected FTP, Rclone, or Mega activity, or proxying consistent with Ngrok or modified Rsocks.
- Signs of lateral movement between systems or custom backdoor activity.
Preserve relevant logs and escalate through your incident-response process if indicators warrant investigation. The advisory recommends reviewing remote-access logs and monitoring network traffic and lateral movement; it does not provide a single indicator that can confirm or rule out compromise.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Mitigations: reduce access, theft, and recovery risk
The joint advisory recommends controls that address different stages of an intrusion. Their operational value depends on implementation and coverage.
| Priority | Recommended measures | Primary value |
|---|---|---|
| Remote access | Inventory authorized remote-access software and review logs for abnormal use; require approved paths such as VPN or VDI; block common remote-access ports and protocols at the perimeter. Limit RDP, close unused ports, use account lockouts and phishing-resistant MFA, and log login attempts. | Reduce exposure and make unauthorized access easier to detect. |
| Execution and scripting | Use application controls or allowlisting to block unauthorized and portable tools. Restrict PowerShell to authorized users, remove earlier versions, use the latest version, and enable module, script-block, and transcription logging. FBI and CISA recommend at least 180 days of retention for relevant PowerShell event logs. | Limit unauthorized tools and preserve evidence for investigation. |
| Credentials and privilege | Review domain controllers, servers, workstations, Active Directory, and privileged accounts for unknown accounts. Apply least privilege and time-based privileged access; protect domain-admin credentials, use Credential Guard where applicable, and avoid plaintext credentials in scripts. | Reduce credential theft opportunities and limit the reach of compromised accounts. |
| Recovery | Keep multiple copies of important data in separate, segmented, secure locations. Maintain offline backups, encrypt and make backups immutable, cover the organization’s data infrastructure, and regularly practice restoration. | Improve recovery options if data is lost, encrypted, or otherwise unavailable. |
| Spread and detection | Patch operating systems, software, and firmware; prioritize known exploited vulnerabilities on internet-facing systems; segment networks; monitor traffic and lateral movement; maintain endpoint detection and antivirus; disable unused ports; and test controls against the activity mapped in the advisory to MITRE ATT&CK. | Reduce opportunities for compromise to spread and improve detection. |
What backup approach helps against ransomware and data extortion?
Backups help restore data availability; they do not prevent a group from stealing data and threatening disclosure. The agencies recommend multiple copies in separate, segmented, secure locations, including offline backups, and call for encrypted, immutable backups that cover the organization’s data infrastructure. Regular restoration practice is essential: a backup that cannot be restored is not a dependable recovery option.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
An external hard drive can be one device for physically separate offline storage, but a single drive by itself does not meet the full recommendation. Plan for separation, encryption, immutability, coverage, and tested restoration rather than relying on a device label or storage medium alone.
Should an organization pay or report an incident?
The agencies do not encourage paying a ransom. Payment does not guarantee file recovery and may embolden further attacks. The advisory urges prompt reporting to a local FBI field office or CISA; Australian organizations can report to ASD’s ACSC. Use the agencies’ current official contact channels when reporting.
The agencies’ stated aim is broader than BianLian alone: “FBI, CISA, and ACSC encourage critical infrastructure organizations and small- and medium-sized organizations to implement the recommendations in the Mitigations section of this advisory to reduce the likelihood and impact of BianLian and other ransomware and data extortion incidents.”
Sources and date scope
- ASD’s ACSC page for the updated joint FBI/CISA/ASD’s ACSC advisory, updated November 20, 2024.
- Original FBI IC3 advisory PDF, published May 16, 2023.
These sources do not establish whether BianLian is conducting an active campaign against a particular organization on October 4, 2026. Treat the activity described above as the agencies’ reported observations through the dates stated, not a live threat assessment.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
