Loading story…
A coordinated destructive cyberattack reportedly targeted more than 30 Polish wind and solar facilities, a major combined heat and power plant, and a manufacturing company. CERT Polska linked the campaign infrastructure to the cluster tracked as Static Tundra, Berserk Bear, Ghost Blizzard, and Dragonfly; attackers allegedly entered through exposed or inadequately secured Fortinet FortiGate VPN access and established a presence in industrial networks.
The attackers deployed DYNOWIPER, a standalone Windows wiper that rapidly corrupts files on fixed and removable drives while avoiding key system directories; one variant also forces a system reboot. Canary-file behavioral protection in the CHP plant's EDR reportedly halted overwriting activity on more than 100 affected systems, demonstrating the importance of behavior-based detection for novel destructive malware.
See the actors and campaigns active against you right now.
5 events from the most recent confirmed update back to the earliest known activity.
During the destructive operation, canary-file protection in the CHP plant's EDR detected and stopped DYNOWIPER's overwriting activity on more than 100 affected machines.
A coordinated cyberattack deployed DYNOWIPER against more than 30 Polish wind and solar facilities, a major combined heat and power plant serving nearly half a million customers, and an opportunistically targeted manufacturing company. CERT Polska attributed the attack infrastructure to a cluster also tracked as Static Tundra, Berserk Bear, Ghost Blizzard, and Dragonfly.
A DYNOWIPER Version A sample, identified as dynacom_update.exe, carries a reported compilation timestamp of 26 December 2025 at 13:51:11 UTC. The standalone Windows wiper corrupts files on fixed and removable drives while excluding key system paths.
CERT Polska documented DYNOWIPER Versions A and B, including variant differences in reboot behavior and timing, along with payload, distribution-script, and network indicators associated with the operation.
Before the destructive operation, the threat actor reportedly accessed organizations through exposed or inadequately secured Fortinet FortiGate VPN devices, then spent months reconnoitering industrial automation, SCADA, and OT networks. The actor also reportedly exfiltrated Active Directory databases, FortiGate configurations, and OT-modernization information.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 13 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CERT Polska reported **late-2025 sabotage activity** against Poland’s energy sector attributed to the threat actor **Static Tundra**, including coordinated intrusions affecting renewable energy facilities, a large combined heat and power (CHP) plant, and an energy-linked manufacturer. The activity showed a shift from espionage to disruption, including an operational technology (OT) incident in which attackers reached a renewable facility’s **Grid Control Point (GCP)** and executed a shutdown of industrial automation devices. Investigators also observed targeting of **Moxa NPort** serial-to-Ethernet devices, including password changes to lock out operators and deployment of corrupted firmware that could prevent controller startup and require manual recovery. The same reporting described two destructive malware families, **DynoWiper** and **LazyWiper**, used to render systems and data unrecoverable; DynoWiper was documented deleting files from **Mikronika RTU controllers**, while LazyWiper appeared to provide redundant destructive capability. Separately, an opinion piece highlighted that attempted disruption of the Polish distribution grid was **rebuffed and reported**, and used the Poland case (alongside speculative discussion of Venezuela) to argue that energy infrastructure attacks are becoming more common; it provided limited additional technical detail beyond noting ambiguity around attribution and the broader trend toward “democratized” attack tooling.
Jun 29, 2026
Polish officials reported a **failed late-December cyberattack** targeting the country’s energy infrastructure, described by Energy Minister Milosz Motyka as the “strongest attack” on the sector in years. The activity on December 29–30 targeted **two combined heat and power (CHP) plants** and attempted to disrupt systems and communications supporting electricity management from **renewable sources** (including wind and photovoltaic installations) and their links to power distribution operators; local reporting indicated the impact could have been significant if successful. Security firm **ESET** said the attempted disruptive operation involved a previously undocumented **wiper** malware it named **DynoWiper**, designed to irreversibly destroy data and render systems inoperable. ESET attributed the activity with **medium confidence** to **Sandworm** (a GRU-linked threat actor) based on overlaps with prior Sandworm-associated destructive campaigns, particularly against Ukraine’s energy sector; Polish leadership publicly blamed Russia-linked groups and indicated additional safeguards and cybersecurity legislation were being prepared to strengthen IT/OT risk management and incident response. Both reporting noted the timing was close to the **10-year anniversary** of Sandworm’s 2015 attacks on Ukraine’s power grid.
Jun 29, 2026
Researchers and Polish incident responders linked a late-2025 cyberattack on Poland’s energy sector to Russia-aligned group **Sandworm**, with ESET attributing the operation with medium confidence based on overlaps with earlier Sandworm wiper activity. ESET said the attackers deployed a new data-wiping malware family it named **DynoWiper**, detected as `Win32/KillFiles.NMO`, against power-grid targets, while CERT Polska published an incident report on the 29 December 2025 energy-sector attack. ESET said it was not aware of any confirmed successful disruption, and the intended operational impact remained under investigation. Separate technical analysis of attacks against Polish wind and solar farm grid-connection substations described destructive actions against operational technology used to connect distributed energy resources to distribution operators. The attackers reportedly abused default credentials and weak security on **Hitachi Relion IEDs**, **Hitachi RTU560** controllers, **Mikronika RTUs**, and **Moxa NPort 6000** serial device servers, deleting critical files, wiping filesystems, resetting configurations, and in some cases uploading malicious firmware to effectively soft- or hard-brick devices. Analysts warned that such OT-focused destruction can prolong outages and recovery far beyond conventional IT wiping, echoing tactics seen in earlier Sandworm-linked grid operations such as **BlackEnergy** and **Industroyer**.
Aug 1, 2026