Cybersecurity incident — 2017-10-24 00:00:00
Affected organization: Kyiv Metro
Affected country: Ukraine
Industry: Transportation and Warehousing
Event type: Disruptive
Event subtype: Data Attack
Motive: Sabotage
Actor: GRU 85th Main Special Service Center (Unit 26165) (FANCYBEAR)
Actor type: Nation-State
Actor country: Russian Federation

Using a tool called Bad Rabbit, a threat actor launched a ransomware operation that encrypted data on networks in Bulgaria, Japan, Russia, Turkey, and Ukraine. The operation is believed to have disrupted the Kiev metro system's payment network and delayed flights at Odessa's airport. In October 2018, the United Kingdom attributed this incident to Russian military intelligence.