Poland

This page covers cyber threats to Poland. It brings together reports from CERT Polska (the national response team run by the research institute NASK), a joint advisory published by the US cyber agency CISA with Polish services among its co-sealers, MITRE ATT&CK, and Brandefense research. CERT Polska publishes yearly national statistics, so this page carries real counts.

Threat groups that official sources link to Poland

Each group below has a profile in our threat group library. Attribution is stated as given by the named body.

APT28: the joint advisory AA25-141A, first published in May 2025, describes a campaign by a Russian military intelligence unit (military unit 26165) that it says is commonly known as APT28. The advisory names Poland among the countries with targeted entities, and says Poland made up 4.0% of the targeted IP camera attempts it measured. Poland’s Internal Security Agency (ABW) and Military Counterintelligence Service (SKW) are among the agencies that released it. CERT Polska adds that APT28 also exploited a Roundcube webmail flaw (CVE-2024-42009) against Polish entities in 2025.

Sandworm: MITRE ATT&CK says Sandworm Team used Prestige ransomware against organizations in transportation and logistics in Ukraine and Poland. MITRE says the group is attributed to unit 74455 of Russia’s military intelligence (GRU).

Dragonfly: in its report of 30 January 2026 on the 29 December 2025 energy attacks, CERT Polska said its analysis of the attack infrastructure showed a high degree of overlap with the infrastructure of an activity cluster that is publicly known under several names, one of them Dragonfly. CERT Polska called this the first publicly described destructive activity attributed to that cluster.

LockBit: CERT Polska recorded 8 attacks involving ransomware from the LockBit family in Poland in 2025. It was one of the most frequent families in its count, behind Qilin with 13.

One group the official sources stress most has no profile here yet: UNC1151, also called Ghostwriter. CERT Polska called it one of the most active clusters it attributes to APT groups in 2025. See the incident page on its campaigns below.

Incidents on record

The incidents listed below are the major ones that CERT Polska documents in detail. Where sources disagree, the incident page says so. Small incidents are not listed.

How attackers target Poland: Brandefense research

Our own research has covered Poland in several posts. In summary, as our posts report:

State-linked espionage and influence: our Ghostwriter profile says the group ran disinformation against NATO forces in Poland and the Baltic states from 2016 to 2019, and in 2020 was heavily engaged in phishing and disinformation aimed at Polish officials. The Winter Vivern profile says its 2021 efforts concentrated on Poland, Ukraine and the Baltic states, with credential harvesting through spoofed government portals. The UAC-0194 report says the group appears to target government, diplomatic and administrative bodies in Ukraine, Poland and Romania using NTLM hash theft. The Lazarus (APT38) profile lists Poland among 18 countries where the group’s malware was seen, and our APT perspective says BlueNoroff targeted financial institutions in Mexico, Poland and Vietnam after the 2016 Bangladesh Bank theft. Our hybrid warfare analysis notes that Poland raised its nationwide cybersecurity threat level as a preventive step after a cyberattack on Ukraine.

Banking trojans and email theft: our Q4 2022 weekly archive says the Godfather banking trojan hit financial service providers in several countries, Poland among the hardest hit. The 2023 archive covers the Chameleon Android trojan, which targeted users in Poland and Australia and imitated the Polish bank IKO. The Strela Stealer analysis says the malware, which steals Outlook and Thunderbird logins, targets only Germany, Spain, the Basque Country, Saudi Arabia and Poland.

Ransomware and the energy sector: the OldGremlin profile says the group expanded into Spain, Poland and Germany in 2021. Our energy posts, on ransomware in energy and on attack surface management for energy, point to the Poland energy sector attacks incident page, and the HermeticWiper report does the same.

How Brandefense helps

Brandefense says it tracks vulnerabilities and exploits on dark web forums to protect its customers’ digital assets (source). In plain words, Cyber Threat Intelligence is how a security team learns which groups and malware are aimed at its country and sector. Dark Web Monitoring is how it learns that staff or customer logins are for sale, and Phishing Monitoring is how it finds fake sites that copy its brand. For Poland this matters because CERT Polska says phishing and fraud dominate its incident counts and that attackers copy well known Polish brands and government portals.

Law and national strategy

The base law is the Act of 5 July 2018 on the National Cybersecurity System, known as the KSC Act (Dz. U. 2018 item 1560). CERT Polska says its team has carried out many of the tasks of CSIRT NASK under Article 26 of that act, including monitoring threats and incidents nationally.

The European NIS 2 Directive required member states to transpose it by 17 October 2024. CERT Polska’s annual report of April 2026 says the Polish transposition has been delayed. It says the planned amendment to the KSC Act would greatly widen the list of sectors and require the competent authority to set up sector CSIRTs. We did not find an official page that confirms the final status of this amendment in October 2026, so check the Ministry of Digital Affairs before relying on it.

How incident response is organized

CERT Polska says there are three national-level teams in the Polish cybersecurity system. CSIRT NASK is run by CERT Polska inside NASK. CSIRT GOV is run by the Head of the Internal Security Agency (ABW) and covers public administration systems and critical infrastructure systems. The third is CSIRT MON. CERT Polska reports that the three work together on campaigns by foreign state-linked groups, for example in May 2024 and in the Polish Space Agency case of February 2025.

Sector teams sit below them. CERT Polska names CSIRT KNF for finance and CSIRT CeZ for health as working in 2025, a team for transport and drinking water planned for 2026, and a planned CSIRT Cyfra for digital infrastructure. Citizens can report to CERT Polska through its incident form, by text message to 8080 or through the mObywatel app.

Sectors and rating

CERT Polska counted 260,783 unique incidents in 2025, up 152% from 103,449 in 2024. Computer fraud was 97% of them, and 96.1% of incidents concerned natural persons. By sector, public administration had 2,801 incidents, wholesale and retail 2,231, education 1,258, healthcare 724, digital infrastructure 495, banking 179, transport 140 and power engineering 52. CERT Polska recorded 179 ransomware attacks, up from 147 in 2024. CSIRT NASK handled 27 serious incidents under the KSC Act, 14 in banking and financial market infrastructure, 8 in health and 5 in transport, and none was classed as significant. We found no national rating or ranking on the pages we opened.

Personal data

The personal data authority is UODO, led by the President of the Personal Data Protection Office. Its website has guidance for data controllers, including how to notify the President of a personal data breach.

Official sources opened for this page give national incident counts for 2025 but no attack counts by named threat group. Further figures for Poland will come from Brandefense Atlas.