Threat-actor profile

← Back to main site

Home/ Threat Actors/ BianLian

🇷🇺BianLian

🇷🇺 BianLian is a tracked threat actor in the Clankerusecase corpus. Attributed to RU. Primary motivation: Criminal. We map 6 detection use cases to this actor across 11 MITRE ATT&CK techniques, with 1 threat-intel article citing them. Active in our corpus from 2026-08-15 to 2026-08-15.

crit 1

View full actor card → All threat actors

6Use cases

1Articles

11Techniques

0IOCs

Known aliases

BianLian

Top techniques

T1021.001 · Remote Desktop Protocol T1190 · Exploit Public-Facing Application T1204.004 · Malicious Copy and Paste

All other tracked techniques

T1059.001 · PowerShell T1059.003 · Windows Command Shell T1059.004 · Unix Shell T1078.001 · Default Accounts T1204.001 · Malicious Link T1539 · Steal Web Session Cookie T1555.003 · Credentials from Web Browsers T1566.002 · Spearphishing Link

Detection use cases (6)

SAP Commerce Cloud CVE-2026-58231: default OAuth client abuse against Data Hub Adapter Bespoke SAP Commerce (Hybris) Java process spawning OS command shell — CVE-2026-58231 RCE payoff Bespoke Infostealer — non-browser process accessing browser cookie/login DBs Internal Asset exposure — vulnerability matches article CVE(s) Internal Phishing-link click correlated to endpoint execution Internal Fake CAPTCHA / clipboard-injected PowerShell (ClickFix / FakeCaptcha) Internal

Threat-intel articles (1)

crit SAP Commerce Cloud CVE-2026-58231 Targeted in Exploitation Attempts Days After Patch · 2026-08-15

Tracked indicators

CVEs (1)

CVE-2026-58231