Sandworm Hackers Target Poland’s Energy Systems with DynoWiper Malware
- Securityish
- Threats & Incidents
Quick Summary
In late December 2025, the Russian hacking group Sandworm attempted a cyberattack on Poland’s power grid using a data-wiping malware called DynoWiper. This attack targeted two combined heat and power plants and a management system for renewable energy sources. The incident highlights ongoing threats to critical infrastructure from state-sponsored cyber actors.
The Securityish Brief
In December 2025, the Sandworm hacking group, associated with the Russian military, attempted to disrupt Poland’s energy infrastructure by deploying a new data-wiping malware known as DynoWiper. This attack occurred on December 29-30 and targeted two combined heat and power plants, as well as a management system for renewable energy sources like wind and solar. Polish officials, including Prime Minister Donald Tusk, indicated that the attack was likely orchestrated by groups linked to Russian intelligence.
DynoWiper, detected by ESET as Win32/KillFiles.NMO, is designed to delete files across a filesystem, rendering the operating system unusable. The malware has a SHA-1 hash of 4EC3C90846AF6B79EE1A5188EEFA3FD21F6D4CF6, but no samples have been found on malware submission sites like VirusTotal. This incident echoes a similar attack by Sandworm on Ukraine’s energy grid in December 2015, which left around 230,000 people without power.
Sandworm, also known as UAC-0113, APT44, and Seashell Blizzard, has a history of conducting disruptive cyber operations. Recently, they were linked to destructive attacks on Ukraine’s education and government sectors in mid-2025. The ongoing activities of Sandworm underscore the persistent threat posed by state-sponsored hacking groups to critical infrastructure.
Implications for Cybersecurity
This incident serves as a stark reminder of the vulnerabilities within critical infrastructure systems. Organizations must remain vigilant against potential cyber threats, especially from state-sponsored actors like Sandworm. The targeting of energy systems highlights the need for robust cybersecurity measures to protect against destructive malware.
Businesses and government entities should prioritize monitoring their systems for unusual activity and ensure that they have comprehensive backup solutions in place. The ability to restore systems quickly after an attack can mitigate the impact of data-wiping malware.
Furthermore, organizations should consider reviewing their cybersecurity policies and incident response plans to address the evolving threat landscape. Regular training and awareness programs can help employees recognize potential phishing attempts or other tactics that may be used to gain initial access to systems.
Key Takeaways
- Regularly back up critical data to ensure quick recovery from potential data-wiping attacks.
- Monitor systems for unusual activity that may indicate a cyber intrusion.
- Review and update cybersecurity policies and incident response plans regularly.
- Conduct employee training to recognize phishing attempts and other cyber threats.
- Implement robust security measures to protect critical infrastructure from state-sponsored attacks.
Key Terms & Concepts
- Sandworm: In this article, Sandworm refers to a Russian state-sponsored hacking group known for disruptive cyberattacks.
- DynoWiper: DynoWiper is a data-wiping malware used by Sandworm to delete files and render systems unusable.
- data-wiping malware: Data-wiping malware is designed to delete files from a system, making it inoperable and requiring restoration from backups.
Read the original article here: https://www.bleepingcomputer.com/news/security/sandworm-hackers-linked-to-failed-wiper-attack-on-polands-energy-systems/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
