Organizations have been warned about a new scam involving physical letters sent via the US Postal Service, impersonating the BianLian ransomware group. These letters claim that the recipient’s corporate IT network has been compromised and sensitive data stolen, demanding ransom payments between $250,000 and $350,000 in Bitcoin. The letters include QR codes for easy payment and Tor links to BianLian’s data leak site, creating a sense of urgency by stating that data will be leaked if payment is not made within ten (10) days. Security researchers have identified several inconsistencies in these letters that suggest they are scams rather than genuine ransomware attacks. The polished English used in the letters is uncharacteristic of BianLian, and the physical delivery method is unusual for ransomware groups, which typically communicate digitally. Furthermore, investigations have revealed no evidence of actual network intrusions or data breaches in the targeted organizations. These letters appear to be an evolution of email extortion scams, now targeting corporate CEOs instead of personal emails. The scam exploits the reputation of the BianLian group to create fear and urgency, pushing executives to make ransom payments without verifying the claims. Organizations are advised to educate employees about such scams and ensure they understand the proper reporting mechanisms. It’s crucial to keep network defenses up to date and check for any active alerts regarding malicious activity. CTIX analysts recommend that companies report these letters to local law enforcement and the FBI.