‘Severe Cyberthreat’ to Critical Infrastructure

The United Kingdom is issuing a “severe cyberthreat” alert to critical infrastructure operators following a December attack against Poland’s energy grid by Russian nation-state hackers.

See Also: On-Demand | NYDFS MFA Compliance: Real-World Solutions for Financial Institutions

Britain’s National Cyber Security Center is urging all operators to review their defensive and resilience posture, warning that a sudden escalation in targeting activity, leading to severe fallout, may occur without warning.

“Although attacks can still happen, strong resilience and recovery plans reduce both the chances of an attack succeeding and the impact if one does,” said Jonathon Ellison, the NCSC’s director for national resilience, in a post to LinkedIn.

“These actions require careful preparation and forethought – they cannot be improvised under pressure,” he said, urging operators to “act now,” following the targeted, destructive and escalatory attack recently faced by Poland.

The NCSC last August updated its Cyber Assessment Framework, designed for operators of essential services and regulators, and which details must-have cyber resilience capabilities “which, if applied correctly, can help to mitigate an attack of this nature,” Ellison said.

The framework details numerous risk management strategies, including ensuring full compliance with such basic practices as timely vulnerability management, always using secure configurations, and maintaining access and identity controls. It advocates the use of monitoring tools and threat hunting, as well as network segmentation and isolation practices.

The framework details how to develop and regularly test cross-organization incident response plans, not least by practicing the switchover from normal to crisis modes. “The faster you can activate alternative processes, the less disruption you’ll experience,” it notes.

The NCSC’s alert followed Polish Prime Minister Donald Tusk revealing in a Jan. 15 press conference that a destructive cyberattack weeks prior attempted to disrupt Poland’s power grid in the dead of winter (see: Wiper Malware Targeting Poland’s Power Grid Tied to Moscow).

In a subsequent incident report, Poland’s national computer emergency response team, CERT Polska, said “coordinated attacks” hit critical service providers starting on Dec. 29, 2025, targeting over 30 wind and photovoltaic farms, a manufacturing sector business, and a major heat and power plant serving 500,000 customers.

“These attacks represent a significant escalation compared to the incidents we have observed so far,” it said.

The attacks also affected both IT systems as well as operational technology environments, including physical equipment, “which is rarely observed in attacks reported publicly,” it said.

Private sector investigators have attributed the attacks to “Sandworm,” a codename for an advanced persistent threat group tied to a Moscow military intelligence unit. The nation-state attack group repeatedly uses wiper malware, including in a number of campaigns against Ukraine since the start of 2025, security experts said (see: Russia’s Destructive Wiper Attacks on Ukraine Rise Again).

Due in part to the wiper malware used in the attacks against Poland, multiple substations that connect wind and photovoltaic farms to the grid, as well as provide protection capabilities, lost communications.

“All of the attacks were purely destructive in nature – by analogy to the physical world, they can be compared to deliberate acts of arson. It is worth noting that this period coincided with low temperatures and snowstorms affecting Poland, shortly before New Year’s Eve,” CERT Polska said.

The attempted disruptions, which destroyed some systems but failed to compromise power production, show how Russian President Vladimir Putin’s regime continues to use cyberattacks as a geopolitical tool, not least to probe NATO allies’ red lines, said Will Thomas, a senior threat intelligence adviser at Team Cymru.

Russia has also been tied to a campaign of sabotage involving actual arson against warehouses connected to supplies being sent to Ukraine, located in not only Poland, but also Lithuania, Germany and the United Kingdom (see: Russia Hacked the Polish Electricity Grid. Now What?).

German cybersecurity expert Haya Schulmann told Information Security Media Group the attacks against Poland highlight how European critical infrastructure operators must shore up their ability to withstand such attempts, and develop more active cyber defense capabilities.

“You don’t necessarily have to attack the attacker. Active cyber defense means having the ability to intervene defensively, to isolate and neutralize malicious activity inside your own networks and dependencies,” said Schulmann, chair for cybersecurity at Frankfurt’s Institute of Computer Science at Goethe University (see: Polish Grid Hack Underlines European Need for Active Defense).

Legislative efforts in Britain aim to make enhanced resilience capabilities mandatory for critical sector operators. The Cyber Security and Resilience Bill, currently in Parliament, is designed to allow regulators to designate more sectors as being critical suppliers of essential U.K. services, including energy, drinking water providers, healthcare and transportation.

The bill would require them to meet minimum cybersecurity standards and report incidents to regulators. The measure aims in part to address supply chain shortcomings that criminals or nation-state attackers might exploit.

“As a nation, we must act at pace to improve our digital defenses and resilience, and the Cyber Security and Resilience Bill represents a crucial step in better protecting our most critical services,” said NCSC CEO Richard Horne.