Loading signal...
Signal
Submitted
Feb 14, 2026, 12:22 UTC
On December 29, 2023, Russian FSB-linked hackers attacked 30 Polish energy facilities, nearly causing a major blackout during cold weather, marking an escalation in Russian cyber sabotage in Europe.
In late December 2023, Poland suffered a significant cyber-attack affecting 30 energy sites, including combined heat and power plants and renewable energy distribution systems, executed by Russian FSB-linked hackers known as 'Berserk Bear'. The attackers gained control of operational technology, inflicting lasting damage and nearly triggering a blackout impacting nearly half a million people amid freezing temperatures. This incident marks a strategic escalation in Russia’s cyber campaign beyond Ukraine, targeting European civilian infrastructure. It follows previous Russian cyber disruptions to railway signaling in Poland and Czech Republic critical for aid routes. Intelligence experts warn of undisclosed Russian footholds in critical infrastructure and potential targets such as international sporting events. Concurrent physical sabotage in Germany was also noted. Analysts assess Russia is increasing hybrid warfare efforts amid geopolitical tensions and upcoming U.S. elections.
Confidence: High
The event explicitly describes Russian FSB-linked hackers conducting aggressive cyber-attacks on Polish energy infrastructure, aiming to cause disruption and damage. There is no described allied defense preparation in the incident.
Source URL
https://archive.ph/X9ud5
Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.
{
"id": "3fa85017-9d94-45c6-82ca-d2a3f0e1244e",
"url": "https://archive.ph/X9ud5",
"source": "extension",
"status": "approved",
"category": "Cyber & Information Warfare",
"subcategory": "Cyber Attacks",
"incident_type": "Attacks on critical infrastructure (energy, transport, hospitals)",
"country": "Poland",
"source_reliability": "C",
"info_credibility": "3",
"tags": [
"Russia",
"Poland",
"cyberattacks",
"Energy infrastructure",
"FSB",
"Berserk Bear",
"Operational technology",
"Cyber sabotage",
"Hybrid warfare",
"Critical infrastructure",
"Cold weather",
"Railway sabotage",
"German naval sabotage",
"Winter Olympics security",
"Putin risk tolerance",
"2028 US election"
],
"nodes": [
"Node 1: Borders"
],
"countries": [],
"where_text": "Cyberspace",
"headline": "Russian-Linked Cyber-Attack Targets 30 Polish Energy Facilities in Major December 2023 Incident",
"description": "On December 29, 2023, Russian-linked hackers conducted cyber-attacks against 30 energy facilities in Poland, targeting combined heat and power plants as well as renewable energy management systems. The attackers gained control of operational technology and caused damage to some equipment beyond repair, nearly triggering a major blackout that could have affected nearly half a million people amid plummeting temperatures. The attack was halted before power outages occurred. Initially suspected to be the work of the GRU-linked Sandworm group, Polish officials and cybersecurity experts attributed the intrusion to the FSB-affiliated hacker unit known as 'Berserk Bear', marking a notable shift to more disruptive operations by this unit historically focused on cautious espionage. This incident reflects an escalation of Russia’s digital subversion tactics in Europe beyond Ukraine, extending to civilian targets with no direct link to the war. Additional context includes prior Russian-backed cyber disruptions to railway signaling in Poland and the Czech Republic affecting aid routes to Ukraine, and sabotage incidents against dams in Norway and a French water mill. Experts warn that Russian cyber intrusions likely penetrate other European critical infrastructure covertly and cite concerns risks to upcoming international events like the Italian Winter Olympics. Concurrently, German police arrested two men in early 2024 linked to sabotage of naval vessels in Hamburg, though no direct Russian attribution was made. Intelligence analysts caution that Russian President Vladimir Putin may escalate hybrid aggression amid perceived Western divisions and prior to the 2028 U.S. presidential election.",
"summary_short": "On December 29, 2023, Russian FSB-linked hackers attacked 30 Polish energy facilities, nearly causing a major blackout during cold weather, marking an escalation in Russian cyber sabotage in Europe.",
"summary_extended": "In late December 2023, Poland suffered a significant cyber-attack affecting 30 energy sites, including combined heat and power plants and renewable energy distribution systems, executed by Russian FSB-linked hackers known as 'Berserk Bear'. The attackers gained control of operational technology, inflicting lasting damage and nearly triggering a blackout impacting nearly half a million people amid freezing temperatures. This incident marks a strategic escalation in Russia’s cyber campaign beyond Ukraine, targeting European civilian infrastructure. It follows previous Russian cyber disruptions to railway signaling in Poland and Czech Republic critical for aid routes. Intelligence experts warn of undisclosed Russian footholds in critical infrastructure and potential targets such as international sporting events. Concurrent physical sabotage in Germany was also noted. Analysts assess Russia is increasing hybrid warfare efforts amid geopolitical tensions and upcoming U.S. elections.",
"actor_primary": "FSB 'Berserk Bear' hacker unit",
"target_primary": null,
"location_text": "Poland",
"location_region": null,
"location_coordinates_lat": 51.9194,
"location_coordinates_lon": 19.1451,
"location_precision": "Regional",
"is_aggressor_signal": true,
"signal_type": "HYBRID_SIGNAL",
"is_hybrid_war_signal": true,
"classification_complete": true,
"hybrid_signal_complete": true,
"classification_confidence": "High",
"classification_rationale": "The event explicitly describes Russian FSB-linked hackers conducting aggressive cyber-attacks on Polish energy infrastructure, aiming to cause disruption and damage. There is no described allied defense preparation in the incident.",
"event_time_utc": "2023-12-29T00:00:00.000Z",
"end_time_utc": null,
"event_time_confidence": "exact",
"created_at": "2026-02-14T12:22:51.043Z",
"updated_at": "2026-11-04T08:35:32.139Z",
"reliability_band": "strong",
"location_precision_band": "regional",
"time_precision_band": "exact",
"severity_band": "significant",
"attribution_confidence_band": "high",
"attribution_basis": "single_source"
}Source reliability
C
Info credibility
3
Event time
Dec 29, 2023, 00:00 UTC
Event time confidence
exact
Location
Poland
Primary actor
FSB 'Berserk Bear' hacker unit
Country
Poland
Tags
Russia, Poland, cyberattacks, Energy infrastructure, FSB, Berserk Bear, Operational technology, Cyber sabotage, Hybrid warfare, Critical infrastructure, Cold weather, Railway sabotage, German naval sabotage, Winter Olympics security, Putin risk tolerance, 2028 US election
Nodes
Node 1: Borders
Signal
Submitted
Feb 14, 2026, 12:22 UTC
On December 29, 2023, Russian FSB-linked hackers attacked 30 Polish energy facilities, nearly causing a major blackout during cold weather, marking an escalation in Russian cyber sabotage in Europe.
In late December 2023, Poland suffered a significant cyber-attack affecting 30 energy sites, including combined heat and power plants and renewable energy distribution systems, executed by Russian FSB-linked hackers known as 'Berserk Bear'. The attackers gained control of operational technology, inflicting lasting damage and nearly triggering a blackout impacting nearly half a million people amid freezing temperatures. This incident marks a strategic escalation in Russia’s cyber campaign beyond Ukraine, targeting European civilian infrastructure. It follows previous Russian cyber disruptions to railway signaling in Poland and Czech Republic critical for aid routes. Intelligence experts warn of undisclosed Russian footholds in critical infrastructure and potential targets such as international sporting events. Concurrent physical sabotage in Germany was also noted. Analysts assess Russia is increasing hybrid warfare efforts amid geopolitical tensions and upcoming U.S. elections.
Confidence: High
The event explicitly describes Russian FSB-linked hackers conducting aggressive cyber-attacks on Polish energy infrastructure, aiming to cause disruption and damage. There is no described allied defense preparation in the incident.
Source URL
https://archive.ph/X9ud5
Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.
{
"id": "3fa85017-9d94-45c6-82ca-d2a3f0e1244e",
"url": "https://archive.ph/X9ud5",
"source": "extension",
"status": "approved",
"category": "Cyber & Information Warfare",
"subcategory": "Cyber Attacks",
"incident_type": "Attacks on critical infrastructure (energy, transport, hospitals)",
"country": "Poland",
"source_reliability": "C",
"info_credibility": "3",
"tags": [
"Russia",
"Poland",
"cyberattacks",
"Energy infrastructure",
"FSB",
"Berserk Bear",
"Operational technology",
"Cyber sabotage",
"Hybrid warfare",
"Critical infrastructure",
"Cold weather",
"Railway sabotage",
"German naval sabotage",
"Winter Olympics security",
"Putin risk tolerance",
"2028 US election"
],
"nodes": [
"Node 1: Borders"
],
"countries": [],
"where_text": "Cyberspace",
"headline": "Russian-Linked Cyber-Attack Targets 30 Polish Energy Facilities in Major December 2023 Incident",
"description": "On December 29, 2023, Russian-linked hackers conducted cyber-attacks against 30 energy facilities in Poland, targeting combined heat and power plants as well as renewable energy management systems. The attackers gained control of operational technology and caused damage to some equipment beyond repair, nearly triggering a major blackout that could have affected nearly half a million people amid plummeting temperatures. The attack was halted before power outages occurred. Initially suspected to be the work of the GRU-linked Sandworm group, Polish officials and cybersecurity experts attributed the intrusion to the FSB-affiliated hacker unit known as 'Berserk Bear', marking a notable shift to more disruptive operations by this unit historically focused on cautious espionage. This incident reflects an escalation of Russia’s digital subversion tactics in Europe beyond Ukraine, extending to civilian targets with no direct link to the war. Additional context includes prior Russian-backed cyber disruptions to railway signaling in Poland and the Czech Republic affecting aid routes to Ukraine, and sabotage incidents against dams in Norway and a French water mill. Experts warn that Russian cyber intrusions likely penetrate other European critical infrastructure covertly and cite concerns risks to upcoming international events like the Italian Winter Olympics. Concurrently, German police arrested two men in early 2024 linked to sabotage of naval vessels in Hamburg, though no direct Russian attribution was made. Intelligence analysts caution that Russian President Vladimir Putin may escalate hybrid aggression amid perceived Western divisions and prior to the 2028 U.S. presidential election.",
"summary_short": "On December 29, 2023, Russian FSB-linked hackers attacked 30 Polish energy facilities, nearly causing a major blackout during cold weather, marking an escalation in Russian cyber sabotage in Europe.",
"summary_extended": "In late December 2023, Poland suffered a significant cyber-attack affecting 30 energy sites, including combined heat and power plants and renewable energy distribution systems, executed by Russian FSB-linked hackers known as 'Berserk Bear'. The attackers gained control of operational technology, inflicting lasting damage and nearly triggering a blackout impacting nearly half a million people amid freezing temperatures. This incident marks a strategic escalation in Russia’s cyber campaign beyond Ukraine, targeting European civilian infrastructure. It follows previous Russian cyber disruptions to railway signaling in Poland and Czech Republic critical for aid routes. Intelligence experts warn of undisclosed Russian footholds in critical infrastructure and potential targets such as international sporting events. Concurrent physical sabotage in Germany was also noted. Analysts assess Russia is increasing hybrid warfare efforts amid geopolitical tensions and upcoming U.S. elections.",
"actor_primary": "FSB 'Berserk Bear' hacker unit",
"target_primary": null,
"location_text": "Poland",
"location_region": null,
"location_coordinates_lat": 51.9194,
"location_coordinates_lon": 19.1451,
"location_precision": "Regional",
"is_aggressor_signal": true,
"signal_type": "HYBRID_SIGNAL",
"is_hybrid_war_signal": true,
"classification_complete": true,
"hybrid_signal_complete": true,
"classification_confidence": "High",
"classification_rationale": "The event explicitly describes Russian FSB-linked hackers conducting aggressive cyber-attacks on Polish energy infrastructure, aiming to cause disruption and damage. There is no described allied defense preparation in the incident.",
"event_time_utc": "2023-12-29T00:00:00.000Z",
"end_time_utc": null,
"event_time_confidence": "exact",
"created_at": "2026-02-14T12:22:51.043Z",
"updated_at": "2026-11-04T08:35:32.139Z",
"reliability_band": "strong",
"location_precision_band": "regional",
"time_precision_band": "exact",
"severity_band": "significant",
"attribution_confidence_band": "high",
"attribution_basis": "single_source"
}Source reliability
C
Info credibility
3
Event time
Dec 29, 2023, 00:00 UTC
Event time confidence
exact
Location
Poland
Primary actor
FSB 'Berserk Bear' hacker unit
Country
Poland
Tags
Russia, Poland, cyberattacks, Energy infrastructure, FSB, Berserk Bear, Operational technology, Cyber sabotage, Hybrid warfare, Critical infrastructure, Cold weather, Railway sabotage, German naval sabotage, Winter Olympics security, Putin risk tolerance, 2028 US election
Nodes
Node 1: Borders