OnsceneALERT
Oct 28, 20213 min
CRITICAL INCIDENT NOTIFICATION
CYBER ATTACK
The National Rifle Association (NRA) has been hit by a ransomware attack, becoming the latest victim of a massive spike in these attacks this year, according to multiple reports Wednesday.
NBC News reported that a Russian cybercriminal group known as Grief posted files on its website on the dark web on Wednesday that it claimed to have stolen from the NRA.
Image Credit: Ft Wayne NBC
Experts told NBC News that Grief was likely a rebrand of the cyber criminal group Evil Corp, which was linked last week to the ransomware attack on Sinclair Broadcast Group.
Multiple U.S. federal agencies took action against the group in 2019 after it was accused of using malware to steal more than $100 million from hundreds of banks and financial entities in over 40 countries, which included sanctioning the group.
Allan Liska, a senior intelligence analyst at cybersecurity group Recorded Future, told The Hill that there was “significant code overlap” between ransomware used by Grief and the variant used by Evil Corp.
“Recorded Future has seen Evil Corp launch multiple ransomware variants over the last year,” Liska told The Hill Wednesday. “This is likely because Evil Corp is a sanctioned entity by the United States; therefore, paying a ransom may result in a fine.”
“By launching multiple variants, Evil Corp is attempting to confuse victims and trick them into paying a sanctioned entity,” Liska said.
The NRA tweeted out a statement from Andrew Arulanandam, the managing director of Public Affairs at the NRA, Wednesday afternoon reiterating its security.
“NRA does not discuss matters relating to its physical or electronic security," Arulanandam said. "However, the NRA takes extraordinary measures to protect information regarding its members, donors, and operations – and is vigilant in doing so.”
The NRA did not respond to requests for further comment on the hack from The Hill. The Cybersecurity and Infrastructure Security Agency (CISA) referred The Hill to the NRA for comment.
Liska pointed to the NRA as being an easy target because of its lack of focus on security over the last year amid escalating legal disputes.
“Given the legal and leadership troubles that the NRA has had this year, their security team, like much of the organization right now, is likely in disarray,” Liska said. “This type of disarray makes an organization more susceptible to cyber attacks, especially ransomware.”
Ransomware attacks have shot up over the past year, to the point that they have become a national security issue that the Biden administration has taken steps to confront.
Russia has come under pressure to crack down on cybercriminal gangs within its borders, with various groups linked to ransomware attacks this year on Colonial Pipeline, meat producer JBS USA and the IT company Kaseya, among many others. The latter two attacks were both linked to the cybercriminal group REvil.
A coalition of federal agencies last week forced REvil offline.
Source Agency (Newsbreak)
Sourcing Link (Newsbreak)
Alerting Agency: OnsceneALERT.com
Subscribe to receive disaster & critical incident alerts like these on your mobile device
Visit us at www.OnsceneALERT.com
OnsceneALERT is a multi-award-winning emergency notification provider when critical incidents threaten public safety;
such as disasters, violent threats, and significant events.
Our community-based mobile alerts provide critical incident awareness of emerging threats and approaching disasters throughout the United States so individuals can be better prepared to protect themselves and their loved ones. Our alerts also increase emergency preparedness and disaster readiness for individuals, families, businesses, schools, government, faith-based organizations, and many more.
"Disasters Don't Give Warnings, But We Do"
Incident Number
2-211026-6101
Alert Type
Critical Incident Notification
Incident Type
Cyber Attack
Incident Occurred
October 27, 2021
Alert Posted
October 27, 2021
Last Updated
October 27, 2021
Incident Location
Fairfax, VA
END OF ALERT