Quick Summary
In December 2025, the Russian hacking group Sandworm attempted a significant cyber attack on Poland’s power infrastructure using a new wiper malware called DynoWiper. The attack, which occurred on December 29 and 30, targeted two combined heat and power plants and a renewable energy management system. Although the attack was unsuccessful, it highlights ongoing threats to critical infrastructure, particularly in light of Sandworm’s history of disruptive cyber activities.
The Securityish Brief
The attempted cyber attack on Poland’s power sector was attributed to the Russian hacking group Sandworm, known for its history of targeting critical infrastructure. On December 29 and 30, 2025, the group deployed DynoWiper, a previously undocumented wiper malware, in an effort to disrupt operations at two combined heat and power plants and a system managing renewable energy sources. Polish Energy Minister Milosz Motyka confirmed the attack was the most significant on the energy infrastructure in years, although it did not succeed in causing disruption.
The Slovakian cybersecurity firm ESET reported that this attack was linked to Sandworm’s previous activities, particularly following Russia’s invasion of Ukraine in February 2022. Prime Minister Donald Tusk indicated that the Polish government is preparing additional cybersecurity measures, including new legislation aimed at enhancing risk management and protection of IT and operational technology systems.
This incident coincided with the tenth anniversary of Sandworm’s earlier attack on Ukraine’s power grid, which utilized BlackEnergy malware and caused significant outages. ESET noted that Sandworm continues to pose a threat to various sectors, emphasizing the need for vigilance in cybersecurity practices.
Understanding the Threat Landscape
Sandworm’s use of wiper malware like DynoWiper underscores the evolving tactics of cyber adversaries targeting critical infrastructure. The group’s history of attacks, particularly against Ukraine, reveals a pattern of disruptive behavior that could extend to other nations, including Poland. Organizations must remain alert to the potential for similar attacks and consider the implications for their own cybersecurity strategies.
As cyber threats become increasingly sophisticated, the need for robust cybersecurity measures is paramount. This includes not only technological defenses but also legislative frameworks that mandate comprehensive risk management and incident response strategies. The Polish government’s proactive approach in response to this attack may serve as a model for other nations facing similar threats.
- DynoWiper: A new wiper malware used by Sandworm in the attempted attack on Poland’s power sector.
- Sandworm: A Russian nation-state hacking group known for targeting critical infrastructure.
- Combined Heat and Power (CHP) Plants: Facilities targeted during the December 2025 cyber attack.
- ESET: The cybersecurity company that reported on the DynoWiper malware and its implications.
- Polish Government: The entity taking steps to enhance cybersecurity in response to the attack.
Key Takeaways
- Monitor your organization’s critical infrastructure for unusual activity, especially if operating in sectors like energy.
- Implement robust cybersecurity measures, including regular software updates and patch management.
- Stay informed about emerging threats and malware trends, particularly those linked to nation-state actors.
- Review and enhance incident response plans to ensure readiness for potential cyber attacks.
- Engage in cybersecurity training for employees to recognize and respond to potential threats.
Key Terms & Concepts
- DynoWiper: In this article, DynoWiper refers to a new wiper malware used by Sandworm in an attempted cyber attack on Poland’s power sector.
- Sandworm: Sandworm is a Russian nation-state hacking group known for its history of disruptive cyberattacks, particularly against critical infrastructure.
- Combined Heat and Power (CHP) Plants: CHP plants are facilities that generate electricity and useful heat simultaneously, targeted during the December 2025 cyber attack.
- ESET: ESET is a Slovakian cybersecurity company that reported on the use of DynoWiper in the attempted attack on Poland’s energy infrastructure.
- Operational Technology (OT): OT refers to hardware and software that detects or causes changes through direct monitoring and control of physical devices, critical in energy sectors.
Read the original article here: https://thehackernews.com/2026/01/new-dynowiper-malware-used-in-attempted.html
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
