Listen to this Post
Introduction: A Silent Cyber Assault on Critical Infrastructure
On December 29, 2025, Poland quietly became the target of one of the most serious cyber offensives against its energy infrastructure in recent years. While households never lost power or heat, the attack itself was anything but minor. According to CERT Polska, coordinated and highly destructive cyber operations struck renewable energy farms, a major heat and power plant, and even spilled into the private manufacturing sector. What makes this incident alarming is not the immediate damage—but how close it came to causing nationwide disruption.
the Incident as Reported by CERT Polska
CERT Polska revealed that over 30 wind and photovoltaic farms were targeted alongside a large combined heat and power (CHP) plant supplying heat to nearly half a million people. A private manufacturing company was also compromised in what appears to have been an opportunistic attack.
The agency attributed the campaign to a threat cluster known as Static Tundra, tracked under multiple aliases including Berserk Bear, Energetic Bear, Dragonfly, and Ghost Blizzard. This cluster is assessed to be linked to Russia’s FSB Center 16, a unit historically associated with cyber operations against energy infrastructure. However, both ESET and Dragos have also linked similar activity—though with moderate confidence—to the Russian state-sponsored group Sandworm, highlighting ongoing attribution uncertainty.
All attacks were described as purely destructive in nature. In renewable energy facilities, attackers disrupted communications between energy farms and grid operators but failed to interrupt electricity production. Similarly, attempts to disrupt heat delivery at the CHP plant did not succeed.
The attackers gained access to internal power substation networks, carried out reconnaissance, and deployed destructive actions such as deleting system files, corrupting controller firmware, and launching a custom wiper malware called DynoWiper. In the CHP intrusion, attackers had maintained covert access since at least March 2025, allowing them to escalate privileges and move laterally across systems.
In contrast, the manufacturing company was likely compromised through a vulnerable Fortinet FortiGate device, suggesting opportunistic targeting rather than strategic planning. FortiGate vulnerabilities also appear central to attacks on grid connection points.
Investigators identified at least four variants of DynoWiper, deployed on Mikronika HMI computers and internal network shares. Access was achieved through SSL-VPN services on FortiGate appliances using static credentials without multi-factor authentication. Attackers masked their movements using Tor exit nodes and IP addresses tied to compromised infrastructure worldwide.
Technically, DynoWiper is simple but effective: it initializes a pseudorandom number generator, corrupts files, and deletes them outright. It lacks persistence, command-and-control communication, or stealth mechanisms—suggesting its sole purpose was destruction, not espionage.
Separately, CERT Polska uncovered another wiper named LazyWiper, used against the manufacturing company. Built in PowerShell, LazyWiper overwrites files with random data, rendering recovery impossible. Analysts suspect parts of the malware may have been developed using a large language model, hinting at evolving attacker workflows.
The attackers also attempted to leverage stolen on-premises credentials to access Microsoft 365 services, extracting data from Exchange, Teams, and SharePoint. Their primary interest appeared to be documentation related to SCADA systems, OT network modernization, and technical infrastructure projects.
What Undercode Says:
A Strategic Warning Shot, Not a Failed Attack
This incident should not be dismissed as an operational failure simply because the lights stayed on. The attackers demonstrated deep knowledge of Poland’s energy infrastructure and OT environments. Their ability to maintain long-term access inside a CHP plant for nearly nine months suggests strategic patience, not recklessness.
Destruction Over Espionage Signals Escalation
Unlike classic cyber-espionage campaigns, Static Tundra’s actions leaned heavily toward destruction. Wiper malware, firmware corruption, and file deletion point to a doctrine focused on pre-positioning for future conflict, where the goal is readiness to disrupt at scale when geopolitical conditions demand it.
FortiGate Weaknesses Remain a Systemic Risk
Once again, perimeter devices became the weakest link. The repeated exploitation of FortiGate SSL-VPN services—often with static credentials and no MFA—shows that basic security hygiene failures continue to endanger national infrastructure. These are not zero-days; they are known risks left unmitigated.
Attribution Confusion Is Part of the Strategy
The overlap between Static Tundra and Sandworm tooling is not accidental. Russian-linked threat actors increasingly blur operational signatures, complicating attribution and slowing diplomatic or defensive responses. Plausible deniability remains a strategic asset.
LLM-Assisted Malware Changes the Economics of Attacks
LazyWiper’s suspected LLM-assisted development is a red flag. It suggests that destructive malware can now be produced faster, cheaper, and with less specialized expertise. This lowers the barrier for future attacks and accelerates iteration cycles for state-sponsored actors.
Operational Technology Is Still Playing Catch-Up
The attackers’ clear interest in SCADA and OT modernization documents reveals a critical gap: many industrial environments remain under-secured while undergoing digital transformation. Modernization without security-by-design simply expands the attack surface.
This Was a Rehearsal
Taken together, the failed detonation of wipers, the reconnaissance across energy networks, and the selective data theft strongly indicate this was a dry run. The objective was learning—how systems respond, where defenses break, and how fast recovery happens.
Poland Was the Target, Europe Is the Message
Poland’s role as a key energy and logistics hub in Europe makes it a strategic testing ground. What worked—or didn’t—here will inform future campaigns across the EU, particularly against renewable-heavy grids increasingly dependent on remote management.
🔍 Fact Checker Results
✅ CERT Polska confirmed no disruption to electricity or heat supply despite destructive intent
✅ DynoWiper and LazyWiper were both verified as non-persistent, destructive malware
❌ No definitive evidence publicly confirms whether Sandworm directly participated
📊 Prediction
Poland’s energy sector will see a surge in mandatory OT security audits and enforced MFA adoption across perimeter devices within the next year. More broadly, Europe should expect similar “silent rehearsal” attacks against renewable infrastructure, where the real damage is not immediate outages—but the intelligence gathered for future crises.
🕵️📝✔️Let’s dive deep and fact‑check.
References:
Reported By: thehackernews.com
Extra Source Hub (Possible Sources for article):
https://www.quora.com/topic/Technology
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
Bing
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon
