A spokesperson for the company told Recorded Future News that Arctic Wolf is aware of at least 20 organizations or executives who have received these letters. The letters have a return address based in Boston, Massachusetts and the FBI said it is still unclear whether there is any actual connection between the people behind the letters and the BianLian ransomware gang. In an alert on Thursday, the FBI said scammers are mailing letters to corporate executives claiming that they stole sensitive data and will publish it unless a demand is paid in Bitcoin. The Russia-based BianLian ransomware gang is known for attacks on charities like Save The Children as well as healthcare firms like Boston Children’s Health Physicians and Amherstburg Family Health Team. “In at least two letters, the threat actor included a compromised password within the How did this happen? section, almost certainly in an attempt to add legitimacy to their claim,” the cybersecurity experts said. Federal law enforcement agencies are warning business executives of a new scam involving criminals using the name of a prominent Russian ransomware gang to extort companies. BleepingComputer first reported on the incident, sharing a photo of the alleged letters sent through the U.S. Postal Service in Boston on February 25. “These letters did not provide a means to contact the threat actor for negotiations, which is often a central piece of any extortion note,” the researchers said. All of the letters reviewed by Arctic Wolf had nearly identical language and demanded ransoms between $150,000 and $500,000. The FBI said it believes the letters are an attempt to force organizations into paying a ransom. The letters also differed greatly from the ransom notes the gang typically leaves on victim networks. “All organizations that received the ransom letter had no activity indicative of a ransomware intrusion. Experts at a website called SuspectFile claimed they spoke to alleged BianLian ransomware actors who denied any involvement in the mail campaign. “Stamped ‘Time Sensitive Read Immediately,’ the letter claims the ‘BianLian Group’ gained access into the organization’s network and stole thousands of sensitive data files,” the FBI said. The letters had QR codes to Bitcoin wallet addresses and demanded payment within 10 days.
This Cyber News was published on therecord.media. Publication date: Fri, 07 Mar 2025 01:20:06 +0000