Ankura CTIX FLASH Update - October 13, 2023

Malware Activity

BianLian Threat Group Claims to have Exfiltrated Data During September Air Canada Cyberattack

BianLian, a ransomware group that has been active since June 2022 and commonly targets critical infrastructure organizations throughout the United States and Australia, has claimed to have exfiltrated 210 gigabytes (GB) of data following the recent Air Canada cyberattack. Air Canada is Canada's largest airline who disclosed a data breach in mid-September 2023 and stated that "an unauthorized group briefly obtained limited access to the internal Air Canada system related to limited personal information of some employees and certain records." The airline also confirmed in their statement that no customer information was accessed during the cyberattack. BianLian, however, is alleging that it exfiltrated the following information from Air Canada: personal information of employees, data regarding vendors and suppliers, confidential documents, SQL backups,