Poland Thwarts Russian Cyber Attack Using DynoWiper Malware on Energy Systems
- Securityish
- Threats & Incidents
Quick Summary
Poland’s energy infrastructure faced a data-wiping malware attack attributed to Russian cyber attackers on December 29 and 30, 2025. The attack targeted two combined heat and power plants and a system managing electricity from renewable sources. Poland’s Prime Minister Donald Tusk indicated that the attackers were linked to Russian services, specifically the Sandworm APT, which has a history of targeting critical infrastructure.
The Securityish Brief
On December 29 and 30, 2025, Poland experienced a cyber attack aimed at its energy infrastructure, specifically targeting two combined heat and power (CHP) plants and a system for managing electricity from wind and solar sources. The attack was attributed to groups linked to Russian intelligence, as stated by Prime Minister Donald Tusk. The malware used in this attack has been named DynoWiper by ESET researchers, who noted its coordinated timing with the 10th anniversary of the Sandworm attack that caused a blackout in Ukraine.
The Sandworm APT, also known as Telebots or Seashell Blizzard, is believed to operate under the Russian GRU and has a history of cyber attacks against the Ukrainian power grid. This includes notable incidents in 2016 and late 2022, utilizing various malware variants such as Industroyer and NotPetya. The recent attack on Poland’s energy systems was successfully thwarted, but it highlighted vulnerabilities in critical infrastructure.
In response to this incident, Poland’s government is working on new legislation to enhance risk management and protection of IT and operational technology systems. This proposed bill aims to introduce stricter requirements for incident response and overall cybersecurity measures.
Implications for Cybersecurity
This incident underscores the ongoing threat posed by state-sponsored cyber attacks, particularly against critical infrastructure. Organizations, especially those in the energy sector, should be vigilant about the tactics employed by groups like Sandworm.
Given the increasing sophistication of cyber threats, it is essential for organizations to regularly assess their cybersecurity posture and implement robust incident response plans. The use of data-wiping malware like DynoWiper indicates a shift towards more destructive cyber tactics that can have severe operational impacts.
For everyday users and organizations alike, understanding the potential for such attacks can inform better security practices, including regular software updates, employee training on recognizing phishing attempts, and ensuring that backup systems are in place and secure.
Key Takeaways
- Regularly update all software and systems to protect against vulnerabilities exploited by malware.
- Implement robust backup solutions to ensure data recovery in case of a malware attack.
- Conduct employee training on recognizing phishing attempts and suspicious activities.
- Review and enhance incident response plans to address potential cyber threats effectively.
- Monitor cybersecurity news for updates on emerging threats and recommended protective measures.
Key Terms & Concepts
- DynoWiper: In this article, DynoWiper refers to the new data-wiping malware used in the recent cyber attack on Poland’s energy infrastructure.
- Sandworm APT: Sandworm APT is a hacking group linked to the Russian GRU, known for targeting critical infrastructure, particularly in Ukraine.
- Combined Heat and Power (CHP): CHP refers to a system that generates electricity and useful heat simultaneously, which was targeted in the cyber attack.
Read the original article here: https://www.helpnetsecurity.com/2026/01/26/poland-energy-malware-attack/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
