Russian APT Sandworm Targets Polish Energy Grid in Coordinated Cyber-Attack

Poland faced a major cyber threat in late December 2025 when its energy infrastructure came under a sophisticated attack attributed to the Russian state-backed APT group Sandworm. Known by multiple aliases—including UAC-0113, APT44, and Seashell Blizzard—Sandworm is widely believed to operate under Russia’s GRU military intelligence. The assault highlights the growing dangers of nation-state cyber campaigns targeting critical infrastructure in Europe.

According to cybersecurity firm ESET, Sandworm deployed a destructive malware tool dubbed DynoWiper, designed to erase critical system data. While ESET reported no successful disruption of Poland’s power grid, the malware’s techniques mirrored previous Sandworm campaigns, offering “medium confidence” attribution. Robert Lipovsky, ESET’s principal threat intelligence researcher, emphasized the striking similarities between this attack and prior operations targeting Ukraine’s energy sector.

The timing of the attack may not have been coincidental. December 2025 marked the 10-year anniversary of Sandworm’s infamous 2015 assault on the Ukrainian power grid, which caused the first-ever malware-induced blackout, leaving roughly 230,000 people without electricity for several hours. Since Russia’s 2022 invasion of Ukraine, Sandworm has maintained a relentless focus on energy targets, leveraging malware such as Zerolot and Sting to disrupt government, logistics, and utility operations while aiming to weaken public morale and economic stability.

Polish authorities successfully repelled the cyber-attack, with Prime Minister Donald Tusk confirming that critical infrastructure remained secure. “The systems we have in Poland today proved effective,” Tusk said, underscoring the robustness of current energy protections. Nevertheless, the government is accelerating plans to implement a National Cybersecurity System Act, aligning with NIS2 directives to strengthen IT and operational technology defenses, improve risk management, and formalize incident response protocols.

The December 29–30 attack targeted two combined heat and power (CHP) plants and a renewable energy facility, but no major outages were reported. The event has nevertheless heightened concerns about potential future attacks, illustrating the strategic role of cyber warfare in modern geopolitics.

What Undercode Say:

Sandworm’s latest assault on Poland is a textbook example of strategic cyber warfare, blending psychological, economic, and operational disruption. The attack demonstrates several critical trends:

APT Persistence: Sandworm’s decade-long activity in Eastern Europe shows a high degree of operational patience. Their campaigns are carefully timed, often coinciding with anniversaries or geopolitical milestones to maximize symbolic impact.

Malware Evolution: DynoWiper reflects ongoing innovation in destructive malware. Its design parallels previous wipers like Zerolot and Sting but shows increased sophistication in targeting both IT and operational technology systems, highlighting a trend toward more precise attacks on critical infrastructure.

Hybrid Attack Strategies: Sandworm leverages cyber operations to complement conventional military objectives. In Ukraine, these attacks have coincided with missile strikes, demonstrating the integration of digital tools into broader conflict strategies. Poland’s experience is a reminder that critical infrastructure is now a frontline in hybrid warfare, not just physical borders.

Resilience and Defense Posture: Poland’s defense highlights the growing importance of national cybersecurity frameworks. The fact that the attack was repelled without outages indicates improved monitoring, segmentation, and response protocols, setting a standard for other nations at risk of similar campaigns.

Political and Psychological Significance: Beyond technical disruption, Sandworm aims to sow uncertainty, erode public confidence, and pressure governments. Timing the attack near the 10-year anniversary of the Ukrainian blackout underscores the psychological element of cyber warfare—reminding victims that these threats are persistent and evolving.

Regulatory Response: Poland’s push for the National Cybersecurity System Act signals a recognition that cybersecurity cannot remain reactive. Stronger regulations and systematic oversight of IT/OT environments will be critical in reducing vulnerabilities exposed by APT attacks.

Implications for Europe: The attack serves as a warning to other European nations. Sandworm’s ability to reach Polish energy assets shows that even well-defended countries face significant risk from state-backed cyber actors. It also underlines the need for coordinated EU-wide strategies to enhance resilience across borders.

Future Threat Vectors: The targeting of both traditional power plants and renewable energy facilities suggests a broader focus on diverse energy sources. As Europe accelerates its energy transition, attackers may increasingly exploit hybrid grids, distributed energy resources, and smart systems that lack mature defenses.

In short, Sandworm’s latest campaign combines innovation, precision, and symbolism, reminding policymakers and cybersecurity teams that defending critical infrastructure is both a technical and strategic challenge.

Fact Checker Results:

✅ Attack attributed to Russian Sandworm APT aligns with ESET reporting.

✅ Malware identified as DynoWiper, no reported outages.

❌ Claims of “successful disruption” are unsubstantiated; Poland’s energy systems remained operational.

Prediction:

⚡ Poland will likely accelerate National Cybersecurity System Act implementation, creating stricter IT/OT defenses.
🔒 Other European nations may adopt similar measures as Sandworm continues operations targeting critical energy infrastructure.
🌐 Expect APTs to increasingly target hybrid grids, combining conventional energy systems with renewable assets, raising the stakes for national resilience.

If you want, I can also create a version with more narrative storytelling, weaving in the 2015 Ukraine attack and the 2025 Poland incident into a tense, suspense-driven timeline. It would make the article read almost like a thriller while staying factual. Do you want me to do that?