Poland distributed energy wiper attack — Sandworm / ELECTRUM

On December 29, 2025 — the 10th anniversary of Sandworm's first Ukraine power grid attack — coordinated wiper attacks struck more than 30 distributed renewable energy facilities across Poland, including wind and solar farms, plus a large combined heat-and-power (CHP) plant supplying heating to nearly half a million residents. Attackers gained initial access through vulnerable internet-facing edge devices, conducted internal reconnaissance, then deployed DynoWiper malware (ESET designation Win32/KillFiles.NMO) to destroy data on HMIs, corrupt firmware on remote terminal units (RTUs), and permanently damage ICS devices at multiple sites. CERT Polska attributed the attack to a cluster called Static Tundra (linked to Russia's FSB Center 16, also tracked as Berserk Bear / Ghost Blizzard). ESET attributed with medium confidence to Sandworm APT. Dragos attributed to threat group ELECTRUM, assessing moderate-confidence overlap with Sandworm. CISA issued a US-audience warning on February 10, 2026.

RTUs and ICS devices permanently damaged / bricked at multiple distributed energy sites; HMI data destroyed; communication between renewable energy farms and the distribution system operator disrupted. No power or heat outages reached end users due to system resilience. CERT Polska described the incident as Poland's largest cyberattack on energy infrastructure in years.