Loading story…
CERT Polska said its follow-up investigation into the destructive December 2025 cyberattacks on Poland’s energy sector uncovered a previously undisclosed parallel attack on a smaller combined heat and power (CHP) plant. Attackers reached the plant’s OT environment, shut down a steam turbine and the water treatment system used for process water, and briefly interrupted cogeneration operations. Operators restored service quickly enough to avoid disrupting heat supplies for about 50,000 residents.
Investigators spent more than three months reconstructing the intrusion path and concluded that the attackers accessed the OT network through a private APN, describing it as a previously unobserved real-world attack vector. CERT Polska said the compromise was enabled in part by a misconfiguration that allowed arbitrary devices within the private APN network to communicate with one another, and warned that similar deployments are common in Poland and likely used in other countries. The agency issued recommendations for organizations that rely on private APN-based connectivity.
See the actors and campaigns active against you right now.
11 events from the most recent confirmed update back to the earliest known activity.
On 2026-08-08, CERT Polska disclosed that the December 2025 campaign included a second combined heat and power plant incident reached through a misconfigured private APN. The disclosure followed an investigation lasting more than three months and included defensive recommendations for organizations using private APNs.
A Truesec report published on 2026-02-09 said Polish CERT attributed the 29 December 2025 destructive attacks on Poland's energy infrastructure to Ghost Blizzard, also known as DragonFly and assessed as part of Russia's FSB Center 16. The report described the campaign as involving at least three attack events, including grid connection points and a combined heat-and-power plant.
On 29 December 2025, coordinated cyberattacks targeted Poland's energy infrastructure. CERT Polska said the campaign struck 30 wind and solar installations and a large combined heat and power plant, and described it as the first attack on Poland's energy sector with a purely destructive objective.
During the late December 2025 attacks on Polish energy companies, defenders identified DynoWiper malware. ESET Research and CERT Polska linked the activity and supporting malware to Russian state-aligned infrastructure and tradecraft, with ESET assessing the campaign as consistent with Sandworm operations.
During the same December 2025 campaign, attackers also hit a smaller CHP plant in Poland that supplied heat to 50,000 residents. The attack shut down a steam turbine and the water treatment system, briefly interrupting cogeneration, but operators restored service quickly enough to avoid disruption of heat supplies.
In December 2025, attackers compromised a FortiGate device at a wind farm, pivoted through a Teltonika router into a private APN lacking client isolation, and used default credentials on an exposed WAGO PLC to bridge into a smaller CHP plant's OT network. By December 25 they had accessed Siemens PLCs, and at about 05:30 on December 29 they put controllers into STOP mode, enabled password protection, shut down the steam turbine and water treatment system, and reset devices to hinder recovery.
Beginning on 18 December 2025, the attacker used access through a private APN to scan for services and expand access toward the smaller CHP plant. On 21 December, the attacker scanned the plant’s internal network for industrial automation and remote access services including S7, Modbus, CODESYS, RDP, VNC, HTTP, and HTTPS.
The NSA, CISA, FBI, DOE, and EPA issued a joint advisory, “Defending Against an Active Threat to Siemens S7 Series PLCs,” recommending organizations verify network segmentation and monitor traffic for anomalous or malicious activity.
ESET released additional technical details on DynoWiper used against a Polish energy company, describing three deployed samples, their wiping workflow, and related tooling such as attempted Rubeus use, LSASS dumping, and rsocx. The report also reiterated medium-confidence attribution of DynoWiper to Sandworm and noted ESET PROTECT blocked execution, limiting impact.
CERT Polska published a follow-up report disclosing that the December 2025 campaign was more complex than previously understood because it included a previously undisclosed parallel attack on a second CHP plant. The report also included recommendations for organizations using private APN-based solutions.
After more than three months of investigation, CERT Polska identified the device used by the attacker and reconstructed the intrusion path into the smaller CHP plant. Investigators concluded the attackers reached the OT network through a private APN, enabled in part by a misconfiguration allowing arbitrary devices within that APN to communicate with one another.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
23 references tracked. Mallory keeps watching after this page renders.
netresec.com
Open sourcexakep.ru
Open sourceinfosecurity-magazine.com
Open sourcecybersecuritynews.com
Open sourcegov.pl
Open sourcewelivesecurity.com
Open sourcewelivesecurity.com
Open sourcecert.pl
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Poland’s Computer Emergency Response Team reported that a **destructive cyber incident** in December 2025 compromised **OT/ICS environments** across the country’s energy sector, including **renewable energy plants** (wind and photovoltaic), a **combined heat and power** facility, and at least one **manufacturing** organization. The intrusion reportedly began through **vulnerable internet-facing edge devices**, after which the actor deployed **wiper malware** that damaged **remote terminal units (RTUs)**, destroyed data on **human-machine interfaces (HMIs)**, and **corrupted firmware** on OT devices—resulting in a loss of operator “view and control” even where renewable generation continued producing power but could not be monitored or controlled as designed. Reporting indicated the activity overlapped with infrastructure associated with a **Russian government-linked** hacking group. CISA issued an alert to U.S. critical infrastructure organizations to amplify the Polish findings and emphasize mitigations for **energy-sector OT/ICS** defenders, highlighting the ongoing risk from **end-of-support edge devices** and the need to harden remote access paths, credential hygiene (including **default credentials**), and incident response planning for scenarios where OT devices may become inoperable or permanently damaged due to firmware corruption. Separate industry commentary and a Dark Reading article provided broader context on the evolution of OT threats (e.g., lessons from Ukraine’s 2015 grid attack and emerging “living-off-the-plant” techniques), but did not add incident-specific details about the Poland event beyond reinforcing the general trend of increasing attacker capability and interest in industrial environments.
Jun 29, 2026
Poland disclosed cyberattacks on five water treatment plants after intruders breached industrial control systems and, in some cases, gained the ability to change settings for pumps, alarms, and treatment equipment. Investigators said the compromises were enabled by basic security failures, including weak passwords and internet-exposed systems, and Polish authorities linked parts of the activity to Russian-aligned actors seeking to disrupt public services and probe infrastructure resilience. The incidents echo the earlier intrusion at a Florida water plant, where attackers reportedly exploited outdated software and poor password practices to gain access to operational systems. Together, the cases underscore a persistent risk across municipal water utilities: insecure remote access, exposed human-machine interfaces, aging control technology, and weak authentication can turn preventable weaknesses into threats to service continuity and public safety.
Jun 29, 2026
Poland’s Internal Security Agency said hackers breached five water treatment plants and could potentially have taken control of industrial equipment, raising the risk of compromised water safety and possible physical harm. The incidents were disclosed alongside a wider warning that sabotage campaigns targeting Polish military sites, civilian entities, and critical infrastructure pose an immediate threat, while Sweden separately reported that suspected pro-Russian hackers attempted to disrupt a thermal power plant but were stopped by built-in protections. Officials in both countries described the activity as part of a broader pattern of increasingly aggressive attacks on operational technology across Europe, particularly against infrastructure in countries supporting Ukraine. In the United States, the disclosures add urgency to CISA’s new **CI Fortify** initiative, which tells critical infrastructure operators in sectors including water, energy, transportation, and communications to prepare to keep essential services running for **weeks to months** while isolated from business networks, vendors, and telecom providers. CISA said the program is designed for scenarios in which attackers may already have access to OT environments and foreign adversaries are prepositioned inside U.S. infrastructure, with guidance focused on isolating control systems, maintaining offline and manual operations, and rehearsing recovery through tested backups, documentation, and component replacement plans.
Jun 29, 2026