Fake BianLian Ransomware Extortion Letter Scam

Overview

Criminals mail physical "ransom letters" to corporate executives falsely claiming to be the BianLian ransomware gang, saying they stole sensitive company data and demanding a Bitcoin payment via QR code within 10 days or the data will be leaked.

How It Works

Scammers send a letter through the U.S. Postal Service directly to a company's CEO or other executives, stamped "Time Sensitive Read Immediately." The letter claims the "BianLian Group" — a real, well-known Russia-linked ransomware gang — breached the organization's network and stole thousands of sensitive files. It threatens to publish the stolen data on BianLian's dark-web leak site unless a ransom of between $250,000 and $500,000 is paid within ten days, using an enclosed QR code that links to a Bitcoin wallet, and states the group "will not negotiate further" with the recipient. In reality, the FBI and USPIS found no connection between the letter senders and the actual BianLian group; the return address traces to a mailbox in Boston, Massachusetts, and investigators noted the writing style doesn't match real BianLian ransom notes. The scam relies on executives panicking over a supposed data breach and paying before verifying whether any real intrusion occurred.

Red Flags

• An unsolicited physical letter stamped "Time Sensitive Read Immediately" claiming a cyberattack already occurred
• A QR code directing payment to a Bitcoin wallet with a strict 10-day deadline
• Claims that the group "will not negotiate" and demands an exact sum between $250,000 and $500,000
• No corroborating evidence of an actual network breach, unusual system activity, or data exfiltration alerts
• Return address tied to a generic suite/mailbox address rather than any verifiable organization

Real Examples

• The FBI issued a PSA (Alert I-030625b-PSA) describing letters mailed to corporate executives, primarily in the healthcare sector, claiming to be from the BianLian Group and demanding payment via an enclosed Bitcoin QR code within 10 days
• The U.S. Postal Inspection Service confirmed letters were mailed with a Boston, Massachusetts return address under the name "BianLian Group" and stated no link was found between the senders and the real ransomware gang
• Security researchers including Guidepoint Security and Arctic Wolf reported receiving scans of identical letters sent to CEOs, with envelopes postmarked in late February 2025

Where It Spreads

How to Protect Yourself

• Do not scan the QR code or send any payment based solely on a mailed letter; verify independently with your IT/security team whether any breach actually occurred
• Notify corporate executives and staff across the organization that this mail scam exists so no one pays out of panic
• Report the letter to the FBI's Internet Crime Complaint Center (IC3) and the U.S. Postal Inspection Service, and preserve the envelope and letter as evidence
• If you have real concerns about a breach, check for actual indicators of compromise through your cybersecurity team rather than relying on the letter's claims
• Treat any extortion demand delivered through an unusual or old-fashioned channel (postal mail) with extra suspicion since legitimate ransomware groups almost never contact victims this way

Related Scams