Snail Mail Ransomware – When Hackers Go Full 1950s and Post You a Demand Letter

8 Mar

Just when you thought ransomware gangs couldn’t get any more creative (or lazy), 2025 delivers this absolute masterpiece of absurdity: cybercriminals are sending ransom demands through actual postal mail. That’s right — not a phishing email, not a dodgy WhatsApp message, but an old-fashioned envelope delivered by the postman, claiming your company’s been hacked and demanding up to $500,000 in Bitcoin to prevent data leaks.

This isn’t a joke — it’s an actual campaign being run right now by scammers pretending to be the notorious BianLian ransomware gang. The catch? Most of the targeted companies haven’t actually been hacked. The whole thing is a bluff, dressed up as a corporate hostage note, designed to panic non-technical CEOs into paying up without checking with their IT teams. It’s part old-school extortion, part psychological warfare — and it’s frankly fucking ridiculous.

What’s Actually Happening?

The scam works like this:

A CEO receives a formal-looking letter through the post, addressed directly to them.
The letter claims that the company’s entire network has been compromised by BianLian, and sensitive data (customer lists, payroll, legal files, etc.) has already been exfiltrated.
The letter demands a ransom payment — typically between $250,000 and $500,000 — paid in Bitcoin to a wallet address conveniently printed on the letter (complete with QR code for ease of payment — how thoughtful).
The letter warns that if payment isn’t made within 10 days, all the allegedly stolen data will be published on the dark web, emailed to customers, regulators, journalists, and — for extra flavour — shared with “class action law firms” to encourage a nice juicy lawsuit.
To make it more convincing, the letter includes the real dark web URLs used by the actual BianLian group — creating the illusion that this is a genuine ransom demand from a real ransomware operation.

The reality?
There’s no hack.
There’s no stolen data.
This is pure bluff and bullshit — a 2025 twist on the Nigerian Prince scam, except it’s now dressed up in cybercrime cosplay.

Why Snail Mail? Isn’t Email Easier?

You might be wondering why these scammers are wasting stamps when they could just spam inboxes like everyone else. Simple: psychological impact. A physical letter, formally addressed to the CEO, lands on their actual desk. It feels serious. It feels personal. It feels like a Very Big Problem™ that needs immediate attention. It bypasses corporate spam filters and makes it through the executive assistant gatekeepers. In short: it gets noticed.

Plus, in some companies, the CEO isn’t exactly tech-savvy. When faced with what looks like a legit legal threat — complete with scary hacker names, Bitcoin addresses, and the suggestion that customers and regulators could get dragged into this — it’s easy for panic to kick in. Especially if the letter lands when IT is off dealing with yet another Teams outage.

The Real BianLian Says ‘Not Us, Mate’

For the record, the actual BianLian gang has nothing to do with this comedy act. BianLian is a real ransomware-as-a-service operation, but they don’t send ransom demands via the post. They’re digital-only — emails, encrypted notes left on servers, and dark web chats. The real BianLian group was quick to deny any involvement, meaning this is some other crew using their name to sound scarier.

That’s a new low — criminals plagiarising other criminals. It’s like knock-off designer handbags, but for extortion notes.

The Anatomy of the Letter – Old School, New Twist

The letters follow a template that would make any scammer proud:

It’s formal. No “Hi Friend” or dodgy typos — it looks like a letter from a solicitor, only more unhinged.
It knows who you are. The CEO’s name, company address, and even some publicly available details (revenue, headcount) are included to make it feel credible.
It escalates fast. Right from the first paragraph, you’re told the data is already stolen, the leak is scheduled, and your only way out is to pay up.
It’s tech-flavoured. Mentions of exfiltration tools, dark web marketplaces, and data breach evidence are sprinkled throughout — even though there’s no actual evidence.
It plays the regulator card. The letter warns that data regulators (like the ICO) will be notified if payment isn’t made — because what CEO doesn’t love a regulatory investigation?
It offers easy payment options. Bitcoin address? Check. QR code for lazy ransoms? Check. No awkward dark web negotiations — just scan, pay, and hope.

The Real Threat – CEOs Acting Alone

This scam works if CEOs panic and act alone. If a CEO gets the letter, freaks out, and wires Bitcoin without looping in IT or legal, the scammers win. And let’s be brutally honest — some CEOs will do exactly that, especially if the letter is believable enough and hits on a Friday afternoon after the CFO has buggered off for the weekend.

This is the biggest risk — not the (imaginary) data breach, but poor crisis handling. The scammers are weaponising fear, formality, and unfamiliarity with cybercrime processes to trick execs into acting rashly.

Why This is a Proper WTF Moment

Think about this:

It’s 2025.
Cybercriminals have AI deepfakes, automated phishing kits, and nation-state malware.
And somehow, we’ve ended up dealing with ransom notes sent via the same method as grandma’s Christmas cards.

It’s so dumb it might actually work, which is both hilarious and horrifying. It also shows how broken cybersecurity awareness still is in some executive circles. If a printed letter about a cyberattack makes you reach for the company chequebook before you even call IT, you’ve already lost.

The Right Response – What to Do if This Lands on Your Desk

If you (or your CEO) gets one of these letters, here’s the actual playbook:

Don’t Panic. Don’t Pay. Don’t Respond.
This is a scam. No payment, no negotiation. Into the bin it goes.
Loop in IT and Legal.
Even though it’s fake, you’ll want a quick check of systems just in case. And legal will want a copy for records and potential reporting.
Alert Staff.
If the CEO gets one, chances are other execs or senior staff might too. Make sure everyone knows it’s bogus.
Report It.
In the UK, you’d report this straight to Action Fraud. In the US, FBI Internet Crime Complaint Center (IC3) will want a copy. They’re tracking the campaign.
Use It as a Teaching Moment.
This is a great excuse to remind your leadership team how real ransomware works — and why you always involve security and legal before even thinking about responding to a ransom demand.

Don’t Let a Postage Stamp Trigger a Panic Attack

📌 Tell your leadership team about this scam — now.
📌 Make sure everyone knows: no payments, no responses, no knee-jerk reactions.
📌 Reinforce your incident response plan. If there’s ever a real breach, the process should already be clear.
📌 And for the love of all that’s holy, teach your execs how real ransomware works — so they know that if the postman delivers your ransom note, it’s already bullshit.

Source	Description	Link
BleepingComputer	Initial discovery and analysis of the snail mail ransomware scam	BleepingComputer Article
GuidePoint Security	Detailed investigation into the fake BianLian letter campaign	GuidePoint Security Blog
Arctic Wolf	Analysis of why snail mail increases perceived legitimacy in executive scams	Arctic Wolf Blog
Action Fraud UK	Public advisory on reporting fake ransomware letters in the UK	Action Fraud Ransomware Advisory
FBI IC3	US guidance on reporting mail-based cyber extortion	FBI IC3 Public Service Announcement

Noel Bradford

Noel Bradford – Head of Technology at Equate Group, Professional Bullshit Detector, and Full-Time IT Cynic

As Head of Technology at Equate Group, my job description is technically “keeping the lights on,” but in reality, it’s more like “stopping people from setting their own house on fire.” With over 40 years in tech, I’ve seen every IT horror story imaginable—most of them self-inflicted by people who think cybersecurity is just installing antivirus and praying to Saint Norton.

I specialise in cybersecurity for UK businesses, which usually means explaining the difference between ‘MFA’ and ‘WTF’ to directors who still write their passwords on Post-it notes. On Tuesdays, I also help further education colleges navigate Cyber Essentials certification, a process so unnecessarily painful it makes root canal surgery look fun.

My natural habitat? Server rooms held together with zip ties and misplaced optimism, where every cable run is a “temporary fix” from 2012. My mortal enemies? Unmanaged switches, backups that only exist in someone’s imagination, and users who think clicking “Enable Macros” is just fine because it makes the spreadsheet work.

I’m blunt, sarcastic, and genuinely allergic to bullshit. If you want gentle hand-holding and reassuring corporate waffle, you’re in the wrong place. If you want someone who’ll fix your IT, tell you exactly why it broke, and throw in some unsolicited life advice, I’m your man.

Technology isn’t hard. People make it hard. And they make me drink.

https://noelbradford.com