Grief

Profile narrative

Grief, also known as PayorGrief, is a ransomware‑linked threat actor that has been publicly tied to Russia and to the Evil Corp cybercrime syndicate, which is subject to U.S. Treasury sanctions. The group’s affiliation with Evil Corp links it to the evolution of ransomware families such as DoppelPaymer and WastedLocker, adaptations that were created to evade sanctions restrictions. This connection complicates any potential ransom negotiations because payments to sanctioned entities are prohibited under U.S. regulations. The actor’s location is noted only as Russia in the available reporting, with no further detail on its organizational structure or size.

Grief’s targeting pattern shows a focus on sectors that hold sensitive personal or operational data, including healthcare providers, educational institutions, municipal governments, and food‑production facilities. Victims have ranged from a national nonprofit organization and a dermatology‑plastic surgery practice to school districts in multiple U.S. states, an Italian municipality, and an Austrian dairy company. The geographic spread of incidents spans the United States and Europe, indicating a trans‑national operational reach. The actor’s stated objective is financial gain achieved through ransomware deployment and data extortion, often accompanied by threats to leak or destroy stolen data if victims involve law enforcement or engage third‑party recovery firms. In some cases the group has claimed to delay publication of stolen material for several weeks to increase pressure, and it has asserted that it avoids targeting general healthcare while treating elective procedures such as plastic surgery as a distinct, lucrative target.

The group’s tactics, techniques and procedures consistently involve the deployment of ransomware to encrypt systems, followed by the exfiltration of data that is subsequently posted on a leak site to coerce payment. This double‑extortion model is reinforced by explicit warnings that non‑payment or outside assistance will result in the public release or outright destruction of the victim’s files. Grief has been observed using ransomware strains associated with Evil Corp, such as DoppelPaymer and WastedLocker, and it has referenced a 21‑day waiting period before leaking data in at least one incident. The actor also employs a staged release strategy, publishing data in increments to maintain pressure on the target over time. These behaviors reflect a focus on maximizing financial return while attempting to deter victims from seeking external assistance.

Notable publicly reported operations attributed to Grief include the October 2021 ransomware attack on the National Rifle Association, during which tax documents, investment records and grant applications were leaked as proof of the intrusion. In September 2021 the group struck Greensville County Public Schools in Virginia, exfiltrating and publishing over 4,600 special‑education‑related PDF files containing personal and medical information about students. A June 2021 incident involved a Florida‑based dermatology and plastic surgery practice where financial records, patient identifiers and even full credit‑card numbers were posted after the group claimed the sector was a lucrative target separate from general healthcare. Additional incidents from mid‑2021 include attacks on school districts in Texas, Mississippi and New York, a psychiatric‑support provider in New York, an Italian municipality that saw approximately 900 MB of resident data released, and an Austrian dairy firm that suffered a total IT‑system collapse after password changes. These examples illustrate the actor’s repeated use of ransomware and data‑leak tactics across multiple industries and regions.

Incidents

Attributed incidents are available to members.

Sources

Sources available to members: 196 sources.