ESET Links Poland Grid Attack to Russian Sandworm Group

A cyberattack targeting Poland's electricity grid on December 29 and 30, 2025, has been attributed to Sandworm, a hacking group linked to Russia's military intelligence agency, the GRU, according to security firm ESET. The assault, which aimed to disrupt power distribution but caused no outages, struck during peak winter demand and coincided with the 10-year anniversary of a similar operation that blacked out parts of Ukraine.

ESET researchers identified the malware used in the attack as DynoWiper, a destructive wiper designed to erase data on infected systems and render them inoperable. The firm analyzed the malware's code and the attackers' tactics, techniques, and procedures, finding strong similarities to previous Sandworm operations. "Based on our analysis of the malware and associated TTPs, we attribute the attack to the Russia-aligned Sandworm APT with medium confidence due to a strong overlap with numerous previous Sandworm wiper activity we analyzed," ESET stated. The targets included two combined heat and power plants and a renewable energy management system, with the hackers attempting to interfere with communications between renewable installations and power...