Cybersecurity incident
Date: 2017-05-12 00:00:00
Affected organization: Russian Railways
Affected country: Russian Federation
Industry: Transportation and Warehousing
Event type: Disruptive
Event subtype: Data Attack
Motive: Financial
Actor: NGB 3rd Technical Surveillance Bureau
Actor type: Nation-State
Actor country: Korea (the Democratic People's Republic of)
Description: A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ'Ãâ 'ÃÆÃ¢â¬Â 'ÃÆÃ'ÃÂ¢Ã¢'Â¬ÃÂ ''ÃÆÃ'Ãâ 'ÃÆÃ¢â¬Â ''ÃÆÃ'Ãâ ''ÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.