Grief Ransomware Gang Claims Successful Attack on NRA

Grief, the ransomware outfit that many believe to be an entity closely connected to the EvilCorp ransomware gang, claimed a successful attack on the US National Rifle Association. The NRA responded to the claims with an ambiguous statement on its Twitter account.

The National Rifle Association prides itself to be the oldest existing civil rights organization in America. However, it may have ended up in a situation where a gun cannot help stop the bad guys.

Following the Grief gang boast about successfully hacking the NRA, the Association stated that it "does not discuss matters relating to its physical or economic security". This statement was followed by a reassurance that the NRA takes digital security very seriously and is always doing its best to protect "members, donors, and operations".

Despite the NRA's unwillingness to provide any hard information on the matter, security researchers examining the alleged attack found that Grief had already put up a number of files as proof of their success. After closer inspection by researchers, it turned out that they comprised NRA board meeting minutes and paperwork relating to grant agreements. This lends significant credibility to the claims made by the hackers, who threatened to leak more documents if the ransom demands are not met.

In their coverage of the event, ZDNet also reminded that Grief, being an extension of the EvilCorp group, is under sanctions from the US treasury and any ransom payments made to the group need to be made after receiving permission from US authorities first. Assuming the attack is real, this puts the NRA in an even tighter spot. On the other hand, one might also speculate that the NRA are hardly the type of people to do any bargaining with cyber extortionists.

As with all cyber attacks and all dealings with criminals, there is also no guarantee that Grief will not leak the files regardless of whether the ransom payment is made or not.

EvilCorp is the entity that was behind multiple attacks on a number of US-based entities, culminating in the attack on tech company Garmin, which prompted the US Treasury Department to issue formal sanctions against the hacker group.