2021 National Rifle Association ransomware attack
On October 27, 2021, a Russian hacker group known as Grief published 13 documents attributed to the National Rifle Association of America (NRA) in a ransomware scam, claimed to have hacked the organization, and threatened to release more NRA documents if the undisclosed ransom was not paid. Background On October 21, 2021, the Federal Bureau of Investigation hacked and shut down REvil, a major hacking organization involved in ransomware scams. In response, other ransomware groups shared anti-United States messages on the dark web. Prior to the ransomware attack, the National Rifle Association had been involved in multiple legal disputes, which Recorded Future analyst Allan Liska argued may have made them an easier target for cyberattacks as attention within the organization was pulled away from their security. Ransomware attack Initial release of documents On October 27, 2021, Grief published 13 documents on their website as part of a ransomware scam, attributing them as internal documents belonging to the NRA and claiming to have hacked the organization. As reported in Wired, the hack likely took place within the week prior to the release of documents. The group threatened to release more files if the ransom (an undisclosed amount of money) was not paid. An anonymous person with direct knowledge of the events at the NRA told Associated Press that the group had been having issues with its email system in the week prior to the publication of files by Grief, which is a potential indicator of a ransomware attack. On October 28, The Register reported that it was unknown whether the hack had targeted the headquarters of the NRA or one of its local branches. The leaked files included the minutes from an NRA board meeting that occurred shortly before the release of documents as well as multiple files related to grants. The Trace reported that one document appeared to be a late 2019 grant application made to the NRA by David Kopel on behalf of the Independence Institute for $267,000, with $248,500 earmarked as Kopel's salary. Kopel has repeatedly filed amicus briefs supporting the NRA in court, and has not disclosed a financial connection to the organization. Related Twitter activity After the ransomware attack was announced by Grief, hundreds of Twitter accounts that had all been created in August and September 2021 shared tweets about the attack. Most of the accounts had feminine names, and the majority used the default Twitter profile photo while others used pictures that appeared to be taken from the online dating services Shuri-Muri or Tralolo. Some of the same accounts had previously posted about an earlier ransomware attack by Grief or about the NRA, gun violence, or Nazis. , it was unclear whether there was a connection between Grief and the network of Twitter accounts. Temporary removal of released documents On October 29, Grief removed the documents attributed to the NRA from the dark website where they had been published. Brett Callow, a threat analyst employed by Emsisoft, noted that while the delisting of the NRA