Summary
In March 2025, a new scam campaign emerged, targeting company
executives with physical letters demanding ransom payments. These
letters falsely claim to be from the BianLian ransomware group,
threatening that corporate IT networks have been compromised and
sensitive data stolen. The letters demand payments between $250,000
and $350,000 to Bitcoin wallet addresses, with a threat to leak
data if payment is not received within 10 days. The scam mimics
traditional ransomware notes, complete with QR codes for Bitcoin
transfers and Tor links to legitimate BianLian data leak sites.
However, cybersecurity experts have identified several
inconsistencies, such as polished language uncharacteristic of
BianLian, newly generated Bitcoin wallets with no prior ransomware
activity, and the unusual use of physical mail for delivery.
Investigations have found no evidence of actual data breaches,
leading analysts to conclude that the letters are an impersonation
attempt to
