Real-Case Analysis #59: BIANLIAN's Ransomware Attack on Nippon Steel

Nippon Steel, one of the world's largest steel manufacturers, has recently been targeted by a ransomware attack affecting its U.S. operations. The incident, which came to light on February 13, 2025, involves the ransomware group known as BIANLIAN.

Incident Overview

Breach Details

What Happened

The BIANLIAN ransomware group carried out a cyberattack on Nippon Steel USA, successfully exfiltrating approximately 500 GB of sensitive data from the company's US division networks. The attackers are now threatening to release this data in parts unless their demands are met.

Initial Point of Entry

The specific initial point of entry for the BIANLIAN ransomware group into Nippon Steel USA's networks has not been publicly disclosed in the available information.

Attack Vector

While the exact attack vector used by BIANLIAN in this specific case is not mentioned in the search results, the group is known to typically exploit vulnerabilities in public-facing applications or use stolen credentials to gain initial access to target networks.

Timeline

The key date in this incident is February 13, 2025, when the BIANLIAN ransomware group posted information about the breach on their dark web leak page. This date marks both the discovery of the breach and the public disclosure of the attack. The exact start date of the breach is not provided in the available information.

Data Compromised

• Accounting records
• Client financial data
• Client personal data
• Network user personal folders
• Files from management PCs
• Fileserver data
• Production data
• Personnel information

Root Cause Analysis

Primary Cause

Based on the available information, the main factor that led to the breach of Nippon Steel USA's systems appears to be the exploitation of vulnerable Remote Desktop Protocol (RDP) access. While the specific initial point of entry for this particular attack is not explicitly stated, the search results provide insights into the typical methods used by the BIANLIAN ransomware group:

• The threat actors are known to gain access to victims' networks through the use of valid Remote Desktop Protocol (RDP) credentials.
• These RDP credentials are likely acquired from initial access brokers or through phishing campaigns.
• The group also targets public-facing applications, potentially exploiting vulnerabilities like the ProxyShell exploit chain.

Contributing Factors

• Exploitation of Vulnerable VPN Devices: The company may have been using FortiGate firewalls for VPN services, which are known to be potential entry points for ransomware attacks if not properly secured or updated.
• Lack of Timely Security Updates: The company might not have applied the latest critical vulnerability patches to their systems, indicating potential issues with their security operations.
• Ongoing Corporate Restructuring: Nippon Steel was in the midst of a high-profile merger attempt with US Steel, which was blocked by the US government. This corporate turmoil may have distracted from cybersecurity efforts.
• BianLian's Evolving Tactics: The ransomware group had recently shifted to a primarily data exfiltration-based extortion model, which may have caught some organizations off guard.
• Potential Use of Valid RDP Credentials: BianLian is known to gain initial access through compromised Remote Desktop Protocol (RDP) credentials, which could have been a factor in this attack.

Impact Analysis

Impact on Individuals

• Potential identity theft due to stolen personal and financial data
• Added responsibilities and pressure to comply with new security measures implemented after the breach
• Exposure of sensitive personal information
• Vulnerability to future phishing attempts or social engineering attacks using the stolen data

Impact on Organization

• Potential Ransom Payment: While not confirmed, the company may be negotiating to pay a ransom to prevent data release, which could be substantial given the scale of the attack.
• Operational Disruptions: The attack may lead to temporary shutdowns or reduced productivity, resulting in revenue losses.
• Investor Concerns: The incident may impact investor confidence, potentially affecting stock prices and future investment prospects.
• Data Loss: If the stolen data cannot be recovered, it may lead to long-term operational issues and loss of intellectual property.

Lessons Learned

Key Takeaways

• Invest in Robust Cybersecurity: Prioritize secure systems and keep them updated to prevent vulnerabilities that attackers can exploit.
• Implement Strong Access Controls: Limit and secure remote access points, particularly RDP, which is often targeted by ransomware groups.
• Prepare for Operational Disruptions: Have plans in place to maintain critical operations manually if systems are compromised.
• Learn From Industry Incidents: Stay informed about attacks on similar companies and implement lessons learned proactively.