Loading story…
The National Rifle Association confirmed it was hit by a ransomware attack after the Grief gang claimed responsibility and said it had stolen data from the organization. Reports said the attackers listed the NRA on their leak site and threatened to publish files, adding the group to a growing list of high-profile organizations facing double-extortion campaigns in which criminals both encrypt systems and exfiltrate sensitive information.
The incident drew attention because the NRA acknowledged the compromise months after it occurred, while details about the scope of affected systems and data remained limited. The case underscored how ransomware operators continue to use public leak portals and reputational pressure to force payment, even when victims do not immediately disclose the full extent of an intrusion.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
The National Rifle Association confirmed in March 2022 that it had suffered a ransomware attack the previous year. The disclosure established the organization as a victim of a previously undisclosed cyber incident.
During the EOS initial coin offering, attackers used a breach to conduct a phishing scam targeting participants. The incident was reported as affecting the cryptocurrency fundraising process and exposing contributors to fraud.
Intel said the newly disclosed processor vulnerability was not unique to Intel chips and that any performance impacts from mitigations would be workload-dependent. The statement came as the industry publicly acknowledged major speculative execution flaws affecting modern processors.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
theverge.com
Open sourcefortune.com
Open sourcetheverge.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ransomware operators have expanded **double-extortion** tactics by targeting people around a victim organization, including senior executives, employees, customers, and business partners, to force ransom payments. Reporting tied the approach primarily to the **Clop** ecosystem, with similar behavior also attributed to **REvil** affiliates. Attackers were described as prioritizing executive mailboxes and workstations to find sensitive files, litigation records, and internal discussions that could be used to embarrass leadership or strengthen negotiations. The pressure campaign also extended beyond the company itself, with gangs emailing victims’ customers and associates to amplify reputational and legal risk. One cited case involved **RaceTrac Petroleum**, where data stolen via exploitation of a zero-day in **Accellion File Transfer Appliance** services used by a third party included some customer contact details, though the company said its corporate network and payment systems were not affected. Similar outreach was reportedly used against people linked to the **University of California**, underscoring how ransomware groups increasingly use public exposure and direct contact with stakeholders as leverage even when stolen data may later be leaked regardless of payment.
Aug 15, 2026
U.S. and South Korean cyber authorities issued a joint warning that the **Gunra** ransomware-as-a-service operation is targeting government and critical infrastructure organizations worldwide, using a **double-extortion** model that steals data before encrypting systems and threatening publication on a Tor-based leak site. The group, which appears derived from leaked **Conti** source code and emerged in 2025 before expanding into a formal affiliate program in 2026, has hit sectors including healthcare, finance, government, manufacturing, transportation, utilities, academia, media, and retail across multiple regions. Authorities said Gunra and its affiliates recruit initial access brokers, including penetration testers and self-described ethical hackers, and often demand more than **$10 million** with payment deadlines of five to seven days. The advisory says Gunra commonly gains privileged access by exploiting known vulnerabilities in internet-facing infrastructure, particularly **Fortinet firewalls**, as well as VPN and RDP-exposed systems, before moving laterally, stealing data, and deploying ransomware on Windows and Linux environments. Separate research on the Linux variant found a major cryptographic flaw: the malware generates `ChaCha20` key material with `rand()` seeded by `time()`, potentially allowing defenders to recover `.GNRA` files without paying if timestamps are preserved. Officials urged organizations to rapidly patch exposed edge devices, segment networks, and maintain offline immutable backups, while researchers also noted operational-security mistakes by the group and reported possible overlap between Gunra activity and infrastructure or tradecraft previously associated with North Korean actors in attacks on South Korean targets.
Aug 24, 2026
The **World Leaks** extortion group claimed it breached Hungarian media company **Mediaworks** and published nearly **8.5 TB** of allegedly stolen data on its leak site. Mediaworks confirmed an incident involving unauthorized access to a significant volume of illegally obtained data and opened an investigation, while warning that use or publication of the leaked material could be criminal. Local reporting said the exposed files included payroll records, contracts, financial statements, internal communications and notes from a January 2025 editorial meeting that allegedly referenced possible contact with Moscow over articles targeting Ukrainian President **Volodymyr Zelensky**; the authenticity of that memo has not been independently verified. Separately, the **Everest** ransomware group began leaking what it said was a **108 GB** dataset tied to insurer **Liberty Mutual** after alleging the company did not respond to its demands. Liberty Mutual acknowledged the claims and said its investigation so far indicates the incident appears linked to a **third-party vendor** rather than a compromise of its own systems or networks. The allegedly stolen files reportedly contain policyholder data, including names, addresses, policy numbers, and financial and insurance details, underscoring how extortion groups are continuing to pressure victims by publishing sensitive data even when direct network encryption is not evident.
Jun 29, 2026