Wiper Malware Targeting Poland’s Power Grid Tied to Moscow

Russian military intelligence attempted to disrupt Poland’s power grid just after the onset of winter using wiper malware, say security researchers.

See Also: Experts Offer Insights from Theoretical to the Realities of AI-enabled Cybercrime

Based on the destructive wiper malware employed, alongside other tactics, techniques and procedures, “we attribute the attack to the Russia-aligned Sandworm APT with medium confidence due to a strong overlap with numerous previous Sandworm wiper activity we analyzed,” said researchers at cybersecurity firm Eset on Friday.

“We’re not aware of any successful disruption occurring as a result of this attack,” they said. They christened the Windows-targeting, data-wiping malware used in the attacks as “DynoWiper.”

Sandworm is a common tracking name for Unit 74455 of Russia’s Main Intelligence Directorate, known for its cyber sabotage, including the repeated targeting of Western critical infrastructure. The Russian military intelligence group is also tracked as APT44 and FrozenBarents.

The attacks occurred Dec. 29, 2025, and Dec. 30, 2025, Polish Prime Minister Donald Tusk revealed in a Jan. 15 press conference. The conference followed a closed-door briefing involving government ministers, heads of the security services and operators also tasked with securing the power grid. The attack targeted two combined heat and power plants, plus a system used to manage energy generated by renewable sources, such as wind turbines and photovoltaic farms.

Tusk said the attempted disruptions failed, thanks to the country’s defenses holding. “At no point was critical infrastructure threatened, meaning the transmission networks and everything that determines the safety of the entire system,” he said. “Everything indicates that these attacks were prepared by groups directly linked to the Russian services,” Tusk said.

A probe into the cyberattacks remains ongoing. The coordinated attack coincided with the 10th anniversary of a Sandworm attack against the Ukrainian power grid that resulted in the first ever malware-facilitated blackout. That December 2015 attack left about 225,000 customers of three regional electric power distribution companies without power for several hours.

The attacks on a NATO member occurred against the backdrop of Russia’s war of conquest against Ukraine, launched in February 2022, which remains now a largely stalemated war of attrition.

“This is definitely another step in escalation and is a threat the energy sectors of all countries adjacent to Russia and Ukraine must take seriously,” said Will Thomas, a senior threat intelligence adviser at Team Cymru.

In the wake of the attacks, the Polish government said it’s reviewing all defenses as well as finalizing its delayed Act on the National Cybersecurity Certification System. The legislation will implement the EU’s Network and Information Security Directive 2, aka NIS2, which is designed to strengthen cybersecurity across an expanded range of critical sectors.

The government highlighted that the law will require domestic energy operators to strengthen cybersecurity for both their IT and operational technology systems, as well as implement refined risk management and incident response practices.

While the government recently pledged that the law would be enacted before the end of 2025, it’s being held up in part by budget and notification disputes (see: European States Spin Wheels on Cybersecurity Directive).

In the meantime, Russia continues to use cyberattacks to probe NATO allies’ red lines, Team Cymru’s Thomas said.

“This shows Russia is going where they have not actually gone before, trying destructive attacks on the energy sectors of NATO alliance countries. This time it was thwarted, but what about the next attack on Poland or Britain, Finland, Romania? To me, we are heading towards a dangerous new threat environment,” he said.

Moscow’s use of wiper malware continues to evolve. In analysis of the December 2015 attacks against Ukraine, the U.S. Cybersecurity and Infrastructure Security Agency reported that the Russian attackers appeared to have obtained legitimate remote access credentials and used them to remotely trigger circuit breakers, “using either existing remote administration tools at the operating system level or remote industrial control system (ICS) client software via virtual private network (VPN) connections.”

Russian hackers in early 2022 launched a barrage of wiper malware targeting military and civilian systems, before apparently burning through their arsenal.

Russian hackers subsequently appeared to focus on cyberespionage as the invasion turned into a war of attrition although Eset reported last November that it has observed in the first months of 2025 a resurgence of Sandworm wiper attacks against Ukrainian targets (see: Russia’s Destructive Wiper Attacks on Ukraine Rise Again).

Russia continues to press kinetic attacks against Ukraine, including its energy infrastructure, at the same time as Moscow engages in trilateral negotiations over ending its invasion, with Ukraine and the United States in Abu Dhabi.

Russian forces pummeled the cities of Kyiv and Kharkiv with drone and missile strikes over the weekend, affecting an estimated 1.2 million individuals as thousands of apartment buildings remained without heat, water or power in the dead of winter, reported The Guardian.

In a speech on Sunday in the Lithuanian capital of Vilnius at a commemoration for the 1863 uprising in Poland and Lithuania against Tsarist Russia, Polish President Karol Nawrocki decried Russian President Vladimir Putin’s attempt to revive Russia’s long-standing, imperialist ambitions. “Tyrants rely on fear and forgetting,” he said.

“The question asked then: ‘Was it worth fighting?’ is not just a thing of the past,” he told the audience, which also included the presidents of Lithuania and Ukraine.