Good Grief! Ransomware gang has only gone and pwned the NRA – or so it claims

October 28, 2021 TH Author

Grief ransomware gang took to a dark portal website where it typically publishes the data of victims that haven’t paid up, to identify its latest target: the National Rifle Association (NRA).

The ransomware gang, believed by the US Department of the Treasury to be a rebranded version of Russia-based Evil Corp, posted 13 documents it claimed it had filched from the NRA on the leak site and threatened to release more if the gun rights advocacy group didn’t pay up. The documents appear to be minutes from a board meeting, some financial documents and grant information.

The NRA has not issued a statement directly addressing the matter, nor responded to The Register‘s request for information, however, it has been guilty of vague-tweeting.

“NRA does not discuss matters relating to its physical or electronic security. However, the NRA takes extraordinary measures to protect information regarding its members, donors, and operations – and is vigilant in doing so.” – Andrew Arulanandam, managing dir., NRA Public Affairs

— NRA (@NRA) October 27, 2021

Four hours later, the org tweeted: “No guns, no freedom.” Ahem.

Whether the ransomware gang attacked the NRA’s central location or a smaller local branch is unknown, as is how it expects the rifle org to pay up when it claims to be bankrupt – although the claim has raised a few eyebrows.

However, going after an organisation like the NRA has drawn some amusement from the internet and may prove to be a more public-relations friendly approach than Grief’s usual go-to targets of school districts, governments and healthcare facilities.

Aside from public and health institutions, Grief appears to have branched out lately. It was linked to the attack on Sinclair Broadcast Group, a telecommunications conglomerate that owns a huge swath of TV stations in the US, and was partially taken off the air earlier this month by data-stealing malware.

Assuming the NRA is not bankrupt and has the means to pay, it could find itself in quite a pickle as the cybergang at arms is under US financial sanctions. The sanctions were imposed on Grief / Evil Corp’s parent company, DoppelPaymer, in December 2019 and mean American-linked businesses cannot buy off these crims without exposing themselves to further risks from regulators. ®