10/02/2026
Actualité
Expert Notice | Cyber attack on Poland’s power grid
On December 29, 2025, an attack targeted wind and solar farms and combined heat and power (CHP) facilities across the Polish power grid. The attack disabled key equipment which resulted in a loss of communication between the facilities and distribution system operators (DSOs).
Dragos (https://www.dragos.com/), involved in an incident response at one of the numerous incidents, assesses with moderate confidence that the threat group ELECTRUM is responsible for the attack.
This represents the first major coordinated attack targeting distributed energy resources (DERs) at scale. These distributed systems are numerous, rely extensively on remote connectivity, and are often allocated fewer cybersecurity resources.
Nature and scope
The attackers targeted 30 wind and solar farms and a combined heat and power (CHP) plant supplying heat to nearly half a million customers in Poland.
The attacker on renewable energy plants exploited default credentials and misconfigured security devices to gain initial access.
The attacker on CHPs gained access to privileged accounts in the Active Directory domain, which enabled unrestricted lateral movement across the organization’s systems.
The campaign involved data-wiping malware (identified as DynoWiper) deployed across IT and operational technology (OT) environments.
Impact
Even though, the attack did not affect the stability of the Polish power and did not result in power outage, the attacker gained access to operational technology systems critical to grid operations.
Recommendations
Electric system asset owners and operators can defend their systems by applying the Five ICS Cybersecurity Critical Controls:
- Incident Response: These kinds of attacks involving multiple remote sites require a more challenging and specific incident response than traditional attacks on centralized infrastructure. Prepare for such kind of Incident handling.
- Defensible Architecture:
- Apply strong authentication controls and eliminate default credentials
- Enhance network segmentation between IT and OT systems
- Harden edge security devices
- Variate security controls across sites to make it harder on the attacker to gain access to several sites
- Network visibility and monitoring: Visibility, detection and logging on all OT assets is crucial to stop attacks at earlier stages and facilitate post-incident analysis.
- Secure Remote access: Distributed energy systems are highly dependent on remote connectivity, which creates an attack surface to be exploited. Organizations must:
- Enforce multi-factor authentication for all remote access
- Maintain comprehensive inventories detailing who has access to each site
- Implement time-bound access sessions that automatically expire after defined maintenance windows
- Monitor for anomalous access patterns, such as a single credential accessing multiple sites in rapid succession
- Engage Threat Hunting actions based on the available IOCs of the Polish Incident.
- Risk-based vulnerability management: Organizations should pay attention to the security level of the edge systems at the DERs such as firewalls and virtual private network (VPN) appliances. Since rapid patching across multiple sites could be challenging, complementary security measures should be considered such as monitoring, network segmentation, and access restrictions.
Sources
- CERT Polska (National Computer Emergency Response Team) report: Energy Sector Incident Report – 29 December
- DRAGOS report: dragos-2025-poland-attack-report.pdf
- IOCs (Indicators of Compromise) from ESET regarding one of the tools used during the attacks: DynoWiper update: Technical analysis and attribution
- The Five ICS Cybersecurity Critical Controls: https://www.sans.org/white-papers/five-ics-cybersecurity-critical-controls
