Cybersecurity incident — 2017-06-27 00:00:00
Affected organization: Kyiv Metro
Affected country: Ukraine
Industry: Transportation and Warehousing
Event type: Disruptive
Event subtype: Data Attack
Motive: Sabotage
Actor: GRU Main Special Center for Special Technologies (Unit 74455) (SANDWORM)
Actor type: Nation-State
Actor country: Russian Federation

Threat actors deploy a tool, called NotPetya, with the purpose of encrypting data on victims' machines and rendering it unusable. The malware was spread through tax software that companies and individuals require for filing taxes in Ukraine and spread globally.Ã'ÃÂ Australia, Estonia,Ã'ÃÂ Denmark, Lithuania, Ukraine, the United Kingdom, and the United States issued statements attributing NotPetya to Russian state-sponsored actors.