Poland’s Energy Sector Breached by Russia-Linked Cyberattacks

On December 29, 2025, Poland experienced a series of cyberattacks that targeted critical infrastructure within its energy sector. The attacks affected various facilities, including at least 30 wind and solar farms, a private manufacturing company, and a heat and power (CHP) plant. CERT Polska reported that all incidents were executed by the same threat actor, identified as a Russia-linked group known by names such as Static Tundra and Berserk Bear.

The attackers gained initial access through internet-exposed FortiGate perimeter devices, which were configured as VPN concentrators and firewalls. These devices allowed authentication without multi-factor authentication, making them vulnerable. Although the attacks caused significant disruptions, such as loss of communication and operational capabilities, they did not impact electricity generation.

In the renewable energy sector, the attackers compromised industrial control systems, including RTU controllers and HMI computers, leading to corrupted firmware uploads and deletion of operating files. This resulted in reduced monitoring and control capabilities for the affected facilities.

In a parallel operation, the attackers targeted a CHP plant supplying heat to nearly half a million customers. They aimed for irreversible data loss through the deployment of a custom wiper malware known as DynoWiper. Evidence suggests that this attack was preceded by months of unauthorized access and reconnaissance.

Additionally, a private manufacturing company was targeted during the same timeframe. Attackers gained access through a compromised Fortinet device configuration that had been disclosed online. They used a PowerShell-based wiper called LazyWiper to destroy critical data within the organization.

Implications for Cybersecurity

This incident highlights the critical vulnerabilities associated with exposed VPN configurations and the importance of implementing multi-factor authentication. Organizations should prioritize securing perimeter devices and regularly review their configurations to prevent unauthorized access.

Moreover, the use of advanced wiper malware like DynoWiper and LazyWiper indicates a shift towards more destructive cyber tactics. Companies in critical sectors must enhance their monitoring capabilities and incident response plans to mitigate the risks posed by such sophisticated attacks.