Article
EASM Best Practices for the Energy Sector
Learn how energy organizations can strengthen cybersecurity with EASM best practices against APTs, ransomware, and AI-powered threats.
Read more
Significant cyber incident
Poland energy sector attacks
On 29 December 2025, coordinated destructive attacks hit more than 30 wind and solar farms, a large combined heat and power plant and a manufacturing company in Poland.
In short
On 29 December 2025, coordinated destructive attacks hit more than 30 wind and solar farms, a large combined heat and power plant and a manufacturing company in Poland. CERT Polska reports that the attackers entered through internet-facing VPN and firewall devices, then used wiper malware, corrupted firmware and default passwords to damage IT systems and industrial devices. Renewable farms lost remote links to the grid operator but kept producing power.
What happened
On 29 December 2025, in the morning and afternoon, coordinated attacks targeted more than 30 wind and solar farms, a large combined heat and power (CHP) plant that heats almost half a million customers, and a manufacturing company. CERT Polska says all of them had a purely destructive aim.
At the renewable farms, the attackers damaged industrial controllers, so the sites lost contact with the distribution system operator. Electricity production was not affected. At the large CHP plant, the wiper was started but the plant’s EDR software blocked it. At the manufacturing company, a PowerShell wiper was used.
In August 2026 CERT Polska described a second, smaller CHP plant (heat for 50,000 residents) hit the same day. A steam turbine and a water treatment system stopped for a short time, but heat supply to consumers was not disrupted.
Timeline
-
March to July 2025
Suspicious activity (reconnaissance, data access, credential attempts) is seen in the large CHP plant's network.
-
8 December 2025
The attacker changes settings on an HMI computer at a renewable site using PowerShell.
-
18 December 2025
The attacker starts scanning a private APN network used by the distribution system operator.
-
25 December 2025
The attacker connects to three Siemens PLCs at the second CHP plant.
-
29 December 2025, about 5:30 a.m.
Activity begins inside the second CHP plant network; it continues until about 10:10 a.m.
-
29 December 2025, about 7:00 a.m.
Industrial control systems at the second CHP plant come under attack; a steam turbine and the water treatment system stop.
-
29 December 2025, morning
The partially automated plan runs at renewable sites; RTUs, relays and serial servers are damaged.
-
29 December 2025
At the large CHP plant the wiper is pushed through a Group Policy Object; EDR blocks it. A manufacturing company is hit with a PowerShell wiper.
-
30 January 2026
CERT Polska publishes its first incident report.
-
10 February 2026
CISA publishes an alert amplifying the CERT Polska report.
-
8 August 2026
CERT Polska publishes its follow-up report on the second CHP plant and the private APN path.
How the attack worked
Getting in
At every affected renewable site, a VPN and firewall device was in use. CERT Polska says the VPN was open to the internet and logins did not use multi-factor authentication (stated in the report text). For the large CHP plant, the attacker connected to the SSL-VPN using Tor nodes and Polish and foreign IP addresses. CERT Polska lists External Remote Services (T1133) for the use of these edge devices.
Damaging industrial devices
At renewable sites, the attacker used default credentials. On Hitachi RTU560 controllers a corrupted firmware file sent the device into a reboot loop. Moxa serial servers were reset and set to unreachable addresses to slow recovery. The report maps this kind of activity to ICS techniques such as System Firmware (T0857), Data Destruction (T0809) and Default Credentials (T0812).
The large CHP plant
CERT Polska saw suspicious activity in the plant’s network from March 2025. Over months it built privileged access, including a forged Kerberos Diamond Ticket (OS Credential Dumping, T1003 is the technique listed for credential theft). On 29 December the wiper (DynoWiper) was spread by a Group Policy Object (Scheduled Task, T1053.005 and Group Policy Modification, T1484.001). EDR canary files halted the overwriting on more than 100 machines. CERT Polska maps the file corruption by the wiper to Data Destruction (T1485).
The manufacturing company
The attacker used a PowerShell wiper called LazyWiper, which CERT Polska says was likely largely written by an LLM. It also downloaded data from Exchange, Teams and SharePoint in Microsoft 365.
The second CHP plant (follow-up report)
The attacker entered a wind farm VPN and firewall device, reached a Teltonika cellular router, and used SSH tunnels into the DSO’s private APN. It scanned the APN, found a WAGO PFC200 controller with a web interface and default credentials, probably enabled SSH, and tunnelled into the CHP plant’s OT network. On 29 December, according to plant staff, Siemens PLCs were put into STOP mode with a password. The attacker then corrupted the WAGO controller’s partition table. CERT Polska says a misconfiguration let devices on the private APN talk to each other, and calls this the first observed use of this vector in a real attack.
ATT&CK techniques
- Technique External Remote Services External Remote Services is a technique where an attacker uses a remote access service that faces the internet, such as a VPN or Citrix, to enter a network or to keep access to it. T1133 · Persistence, Initial Access
- Technique OS Credential Dumping OS credential dumping is when an attacker pulls account login material out of a computer. T1003 · Credential Access
- Technique Remote Services Remote Services is when an attacker uses a valid account to log in to a service built for remote access, such as SSH, RDP or VNC. T1021 · Lateral Movement
- Technique Scheduled Task/Job Scheduled Task/Job is a technique where an attacker uses the task scheduling feature built into an operating system. T1053 · Execution, Persistence, Privilege Escalation
- Technique Valid Accounts Valid Accounts means an attacker logs in with real credentials that were stolen or bought. T1078 · Stealth, Persistence, Privilege Escalation, Initial Access
Who says who was behind it
CERT Polska, 30 January 2026: its analysis of the attack infrastructure (compromised servers, routers, traffic patterns) shows a high degree of overlap with an activity cluster that vendors track under several names (Static Tundra, Berserk Bear, Ghost Blizzard, Dragonfly). CERT Polska notes that public reports describe that cluster as interested in the energy sector and able to attack industrial devices, and that this is the first publicly described destructive activity attributed to it.
CERT Polska, 30 January 2026: the DynoWiper malware has some similarities to tools linked to a cluster called Sandworm, but the level of similarity is too low to tie it to earlier wiper families. CERT Polska cannot conclusively determine whether the Sandworm-linked actor took part. It also says the LazyWiper script cannot be used in attribution.
CERT-EU, Cyber Brief of 2 February 2026: says the attack was attributed to Russia-linked threat actor Sandworm. Sources differ: CERT Polska points to the first cluster and does not conclude on Sandworm. CERT-EU does not say in the text opened who made the attribution.
CISA, 10 February 2026: refers to "a malicious cyber actor(s)" and makes no attribution.
Statements by Polish government officials were not opened for this profile.
Impact
Renewable energy: at least 30 wind and solar farms lost communication with their distribution system operators and remote control. Electricity generation was not affected, and CERT Polska says grid stability was not affected from the transmission operator's view (CERT Polska, 30 January 2026).
The report says all analyzed devices at renewable sites were factory reset by the attacker on the day of the attack (CERT Polska).
Large CHP plant (heat for almost half a million customers): the wiper was blocked by EDR and the attacker did not achieve the intended effect on heat supply. Overwriting was halted on more than 100 machines.
Manufacturing company: attacked the same day with a wiper; the report says the attacker tried to disrupt its operations, with an opportunistic aim.
Second CHP plant (heat for 50,000 residents): a steam turbine and a water treatment system shut down and cogeneration was interrupted for a short time. Heat supply to consumers was not disrupted (CERT Polska, 8 August 2026).
CISA, 10 February 2026: the renewable systems continued production but the operator could not control or monitor them as designed.
Cost figures and recovery times were not stated in the sources opened.
Government and regulator response
- 29 December 2025: At the large CHP plant, EDR software detected and blocked the wiper. At the second CHP plant, operators restored the controllers to factory settings and reloaded logic backups, which cut the outage but deleted logs on the controllers (CERT Polska, 8 August 2026).
- 30 January 2026: CERT Polska published a technical report with the timeline, malware analysis, indicators of compromise, detection rules and ATT&CK mappings .
- 10 February 2026: CISA published an alert to amplify the report. It advises operators to prioritize updates that allow firmware verification and to change default passwords immediately.
- 8 August 2026: CERT Polska published a follow-up report on the second CHP plant. It recommends auditing private APN settings, isolating devices on the APN, limiting traffic to the OT network, and changing default credentials.
Statements by Polish ministers or the prime minister were not opened for this profile.
Lessons
-
Edge devices are the front door
Each affected renewable site had a VPN and firewall device, and CISA says access came through vulnerable internet-facing edge devices. Patch, retire old devices and watch their logs.
-
Multi-factor authentication matters on VPNs
CERT Polska says logins at the renewable sites did not use multi-factor authentication.
-
Default passwords still break industrial gear
RTUs and other industrial devices were reached with default credentials. CISA tells operators to change them immediately.
-
Firmware checks can stop bricking
Corrupted firmware put RTUs in a reboot loop. CISA advises prioritizing updates that allow firmware verification.
-
EDR and canary files can stop a wiper
At the large CHP plant the EDR canary mechanism halted overwriting after more than 100 machines had started.
-
Private mobile networks are part of your attack surface
The second CHP plant was reached through a private APN where devices could talk to each other. CERT Polska advises treating the APN as untrusted.
What to check in your own organization
-
Edge VPNs
List every internet-facing VPN or firewall, confirm patch level and support status, and require multi-factor authentication on every account, including local ones.
-
Default credentials
Search OT devices (RTUs, relays, serial servers, PLCs, routers) for default or shared passwords, and make suppliers change them at install.
-
Firmware verification
Switch on signed firmware update where devices support it and keep known-good firmware images.
-
Private APN and cellular links
Check whether devices on your private APN can reach each other. Turn on client isolation and close web and SSH services on cellular gateways.
-
OT segmentation
Confirm that a compromised edge device or cellular router cannot reach all OT subnets, and that traffic to the OT network is allowlisted.
-
EDR and Group Policy
Alert on new Group Policy Objects that launch programs, and on canary file changes on domain controllers and shares.
-
Logging and recovery
Send logs from edge and OT gateways off the device, and test recovery for a case where devices are factory reset or bricked.
-
Report odd outages
Report unexplained process stops to your CSIRT, even when you suspect a human error.
Where it happened
- Industry Energy and utilities Exposed network devices, destructive attacks, ransomware and state-backed groups that target energy and utility operators, and the rules that apply.
- Country Poland Poland faces cyber threats from state-linked actors such as APT28, Sandworm and Dragonfly, and from ransomware families such as LockBit. Europe
Questions
Was the Polish power grid taken down?
No. CERT Polska says the renewable farms kept producing, and the transmission operator saw no impact on grid stability. Remote control and monitoring by the distribution operator was lost at the affected sites.
Who was behind the attacks?
No single attribution is settled in the sources opened. CERT Polska found infrastructure overlap with an activity cluster known under several vendor names and could not conclusively say whether a Sandworm-linked actor took part. CERT-EU's brief reports an attribution to Sandworm.
How did the attackers get in?
Per CERT Polska, through internet-facing VPN and firewall devices at the renewable sites, the large CHP plant and the manufacturing company. The second CHP plant was reached through a private mobile data network (private APN), starting from a wind farm.
What is a wiper?
Malware that destroys files or disks to make a device unusable. CERT Polska says the malware here had no ransom aim.
What was new about the second CHP plant attack?
CERT Polska says it was the first observed real-world case of reaching an OT network through a private APN, helped by a setting that let devices on that APN talk to each other.
Did heat supply stop?
No. Heat supply was not disrupted at the large plant or the second plant, according to CERT Polska.
In our research
- EASM Best Practices for the Energy Sector October 2025
- Tackling Ransomware Threats in the Energy Sector: Prevention and Response January 2024
- HermeticWiper Malware Technical Analysis Open Report May 2023
- Energy and utilities Industry
- Dragonfly Threat group
- Critical infrastructure Glossary term
Sources
- Energy Sector Incident Report - 29 December 2025 (web page) CERT Polska
- Energy Sector Incident Report - 29 December (full PDF) CERT Polska
- Follow-Up Report of the December 2025 Energy Sector Incident (web page) CERT Polska
- Follow-Up Analysis of the 29 December 2025 Energy Sector Incident (full PDF) CERT Polska
- Poland Energy Sector Cyber Incident Highlights OT and ICS Security Gaps CISA
- Cyber Brief 26-02 - January 2026 CERT-EU
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.