Cyberwarfare / Nation-State Attacks
,
Fraud Management & Cybercrime
,
Governance & Risk Management
Stymied Attack Leaves Poland No Good Options in Responding to Provocation
Poland’s online defenses stopped a Russian cyberattack against the energy grid, but now the Warsaw government is in a bind about how to respond to a digital assault that was a lot more than a crime, but a sliver less than an act of war.
See Also: AI vs. AI: Leveling the Defense Playing Field
Former U.S. Cyber Command and NSA officials tell Information Security Media Group the late December cyberattack crossed important legal and strategic lines. It was carried out directly by a Russian intelligence agency. It destroyed civilian infrastructure. If successful, it would have left a half million Poles without heating in the depths of winter, making injuries or even deaths very likely.
But the fact the attack failed, differing public attributions, and a long history of Russian and pro-Russian hacking activity in Polish networks will make it hard to build a case for retaliation, the former officials warn.
The cyberattack is only the latest, although probably most audacious, example of a campaign of sabotage that Russia and its online proxies have waged against Ukraine’s European allies since the Kremlin launched a war of conquest against Kyiv in February 2022. Arsonists recruited online over Telegram have set fires at warehouses and other logistics hubs connected with the Ukraine war effort in the United Kingdom, Lithuania and Germany, as well as Poland. Pro-Russian hacktivists have attacked a hydroelectric dam in Norway and municipal water and sewage systems in Poland.
These attacks are examples of “hybrid warfare” that aim to cause damage that’s below the level of instigating a real shooting war, explained retired U.S. Marine Col. Kurt Sanger, deputy general counsel at U.S. Cyber Command from 2014 to 2022. Cyberattacks are an ideal weapon for hybrid warfare because they provide a fig leaf of deniability and when directed at IT systems, typically don’t cause permanent destruction.
But the December cyberattack on the Polish grid was distinct from typical hybrid activity. Had it succeeded, it might have crossed the threshold to qualify as an “armed attack,” Sanger said, using the legal term of art that triggers a nation’s right to self defense under the United Nations Charter and the mutual defense provisions of the NATO Charter.
And that would be uncharted territory, he warned, where the risks of escalation are unknown.
“No nation has ever responded to a cyberattack with violence that causes an armed conflict. So we don’t really know where that line is,” said Sanger, now a cyber law attorney in private practice with Buchanan Ingersoll and Rooney PC.
A spokeswoman for the Polish Embassy in Washington referred ISMG to a brief Jan. 15 statement released by the government about a briefing Prime Minister Donald Tusk gave on the cyberattack.
But in at least one regard, Poland’s response is already clear. The government upped its cybersecurity budget to 1 billion euros from 600 million euros in 2024. And at the January briefing, Tusk urged the adoption of a major update to the National Cybersecurity System Act, the nation’s basic cyber law, which will put into practice the European Union’s NIS 2.0 cybersecurity directive.
‘A Significant Escalation Compared to the Incidents We Have Observed So Far’
Poland’s national Computer Emergency Response Team, CERT Polska, said the cyberattack was unprecedented in its technical aptitude and scale.
It released a technical breakdown of the attack, which was three distinct campaigns:
- An attack against 30 substations connecting wind and solar farms to the national grid. This was the attack that impacted OT systems and put communications devices beyond repair. But even if it had succeeded, CERT Polska said, this attack “would not have affected the stability of the Polish power system.”
- An attack against a private company in the manufacturing sector, which appears to be opportunistic and unrelated.
- An attack against a combined heat and power plant supplying heat to nearly half a million residential customers in Poland. This is the attack that could have caused casualties if it succeeded. The hackers used wiper malware to delete data on Windows machines, effectively destroying them.
“These attacks represent a significant escalation compared to the incidents we have observed so far,” the report says.
A half dozen previous cyberattacks against water and sewage systems in Poland have generally been blamed on pro-Russian hacktivists, giving Moscow a thin veneer of deniability. But this attack has been attributed by three different technical sources directly to a Russian intelligence agency.
Which Russian agency was behind the attack depends on who is doing the attribution – a data point over which ambiguity complicates how governments might react.
Slovak cybersecurity firm Eset, which first released technical details of the wiper malware the attackers used, found with “medium confidence,” that the attacker was the notorious threat group commonly tracked as Sandworm, also known as APT44 or Voodoo Bear. U.S. authorities have said the threat actor is really Unit 74455 of the Russian Main Intelligence Directorate or GRU, a spy agency within the Russian military.
Eset analysts dubbed the malware DynoWiper, and found its software familiar to previous wiper campaigns from Sandworm. But it’s not just the use of wiper malware that underlies the attribution. “We study these groups across multiple campaigns, we see how they distribute this malware, how they deploy it,” said Eset Senior Malware Researcher Anton Cherepanov, “They are using the same techniques, they are using the same infrastructure.”
The medium confidence is because Sandworm has in the past worked with other threat actors, said Cherepanov. Other groups had acted as initial access brokers for Sandworm. “It is possible this [malware] was handed off” to some other team.
There are no accepted industrywide standards for defining terms like medium or moderate confidence, said a senior analyst from threat intelligence firm Flashpoint, who requested anonymity. “For us, medium confidence means there is evidence pointing to our conclusion, but there is still a chance that it could be something else,” the analyst said. Flashpoint has not weighed in on the attribution debate about the Polish grid attack.
OT security firm Dragos, which also has data from the attack, attributed with “moderate confidence,” a threat actor it calls Electrum. Electrum’s activities and infrastructure “overlap significantly” with Sandworm, the company said, although it has a long-standing practice of not attributing threat groups to any nation state or government.
CERT Polska, which has access to the most data about the attack, attributed the attack to a different Russian “activity cluster,” the threat actor tracked as Berserk Bear, also known as Static Tundra, Ghost Blizzard and Dragonfly. The FBI has identified this actor as Center 16 of the Russian Federal Security Service, FSB.
Although FSB has engaged in extensive cyber espionage and reconnaissance activities in Poland and other EU and NATO member states, it’s the first time this kind of destructive attack has been attributed to that agency.
“This is the first publicly described destructive activity attributed to this cluster,” CERT Polska acknowledged.
Eset’s Director of Threat Research Jean-Ian Boutin said that attribution is necessarily based on available data, and always aimed to get defenders the most useful information.
“Other organizations have other visibility,” he said about the differing attribution between Eset and CERT Polska. The Polish cyber defense team has data from national networks, and “they came to a different conclusion than us,” he said.
These different attributions underline the difficulty of attributing cyberattacks, said Glenn Gerstell, who was general counsel for the NSA from 2015 to 2020.
A kinetic attack such as a missile launch leaves physical evidence, he said. The evidence trail for a cyberattack is often less clear. There might be gaps, the effects might be diffuse or not obvious. Technical data may be hard to interpret. It might also involve intelligence that can’t be publicly disclosed, he said.
“You’ve got to feel pretty certain about your attribution” before accusing another state of a cyberattack, Gerstell said. “And even when you do know for sure, you’re not necessarily going to want to put that proof out in public, because you don’t want the bad guys knowing how you know it was them.”
But even putting aside any problems with attribution, the “armed attack” threshold remains an issue for Poland, Gerstell said.
Scholars and practitioners of military law, based at the NATO Cooperative Cyber Defense Centre of Excellence, have compiled the Tallinn Manual, widely considered definitive guidance on how the laws of war apply in cyberspace.
The Tallinn Manual scholars considered the question of when a cyberattack might constitute an “armed attack,” the key threshold in international law, Gerstell explained.
According to Article 51 of the UN Charter, a nation subject to armed attack has the right to self defense, meaning they can use military force against whoever attacked them in an exception to the UN ban on using force. And Article Five of the NATO Charter states that “an armed attack against one or more [member states]… shall be considered an attack against them all,” and requires members to come to the aid of any fellow member subjected to such an armed attack.
The Tallinn scholars developed what they call a “scale and effects test,” explained Gerstell. The test basically means that to constitute an armed attack, a cyberattack must cause damage equivalent to a kinetic attack – essentially destruction of property or loss of life.
“It’s a continuum,” said Gerstell. “Looking at an attack on the grid, you can go from a three second blackout where power is restored immediately,” to a multi-day blackout, where hundreds of people die. “Somewhere on the continuum between those two points is the line you cross into ‘armed attack,'” Gerstell said. “But since there’s no court to make a decision on exactly where to draw the line, the result is that in practice every country gets to define for themselves exactly where it is, on a case by case basis.”
These facts give Russia an “asymmetric incremental escalatory advantage,” said Gerstell. Every time Russia carries out a cyberattack that doesn’t cross the victim’s line, and provokes no response, it makes it harder to respond when it eventually does.
Recalling the parable of the frog in the slowly boiling pot of water, Gerstell posits a hypothetical series of cyberattacks on the Polish grid, where the consequences gradually escalate.
“Finally you get to a three-hour blackout causing millions of dollars of physical and economic damage. And at that point, you decide to respond. Well, some people are going to say, ‘Wait a minute, you were OK with the attack last week, which caused a two-hour blackout. Why does three hours across the line?’ Unless you responded to every previous attack – which isn’t going to happen with something perceived as relatively minor – you’re trapped by that dynamic. Of course, at some point you have to respond.”