Signal
Submitted
Feb 1, 2026, 00:14 UTC
In December 2025, Russian GRU-backed Sandworm group likely launched a DynoWiper malware attack on Poland's national power grid, attempting to disrupt communication between renewable energy hardware and power distributors.
In December 2025, cybersecurity researchers, notably ESET, attributed with medium confidence a cyberattack on Poland's power grid to Russia's GRU-linked hacking group Sandworm. The attackers deployed DynoWiper wiper malware targeting Poland's national energy systems, aiming to disrupt communication between renewable energy devices and power distribution operators; however, the attack was unsuccessful. The use of wiper malware aligns with Sandworm's historical pattern of targeting critical infrastructure in adversary countries, including notable attacks on Ukraine. The attack coincided with the ten-year anniversary of Sandworm’s 2015 malware attack on Ukraine's energy sector. Polish officials described this as the strongest cyberattack faced by the power grid in years, leading to arrests of individuals suspected of Russian espionage. Concurrently, Poland is working with NATO to enhance Eastern border security with Belarus, including autonomous weapons and AI surveillance systems, which Russia may perceive as provocative.
Confidence: High
The event clearly describes a hostile cyberattack by Russia's GRU-linked Sandworm group targeting Poland's critical infrastructure in December 2025, confirming aggressor activity. It also details Poland's defensive and deterrence preparations alongside NATO through arrests of espionage suspects and plans for an Eastern Flank Deterrence Line using autonomous and AI monitoring systems, confirming defense preparation. The source is a reputable cybersecurity news outlet citing official statements...
Source URL
https://theregister.com/2026/01/26/moscow_likely_behind_wiper_attack
Source reliability
C
Info credibility
3
Event time
Dec 1, 2025, 00:00 UTC
Event time confidence
unknown
Location
Cyberspace
Primary actor
Sandworm
Country
Poland
Countries
Poland
Tags
Sandworm, GRU, Russia, Poland, Power grid, DynoWiper, cyberattacks, Critical infrastructure, Wiper malware, NATO, Espionage, Renewable energy, Eastern Flank Deterrence
Nodes
Node 1: Borders
Signal
Submitted
Feb 1, 2026, 00:14 UTC
In December 2025, Russian GRU-backed Sandworm group likely launched a DynoWiper malware attack on Poland's national power grid, attempting to disrupt communication between renewable energy hardware and power distributors.
In December 2025, cybersecurity researchers, notably ESET, attributed with medium confidence a cyberattack on Poland's power grid to Russia's GRU-linked hacking group Sandworm. The attackers deployed DynoWiper wiper malware targeting Poland's national energy systems, aiming to disrupt communication between renewable energy devices and power distribution operators; however, the attack was unsuccessful. The use of wiper malware aligns with Sandworm's historical pattern of targeting critical infrastructure in adversary countries, including notable attacks on Ukraine. The attack coincided with the ten-year anniversary of Sandworm’s 2015 malware attack on Ukraine's energy sector. Polish officials described this as the strongest cyberattack faced by the power grid in years, leading to arrests of individuals suspected of Russian espionage. Concurrently, Poland is working with NATO to enhance Eastern border security with Belarus, including autonomous weapons and AI surveillance systems, which Russia may perceive as provocative.
Confidence: High
The event clearly describes a hostile cyberattack by Russia's GRU-linked Sandworm group targeting Poland's critical infrastructure in December 2025, confirming aggressor activity. It also details Poland's defensive and deterrence preparations alongside NATO through arrests of espionage suspects and plans for an Eastern Flank Deterrence Line using autonomous and AI monitoring systems, confirming defense preparation. The source is a reputable cybersecurity news outlet citing official statements...
Source URL
https://theregister.com/2026/01/26/moscow_likely_behind_wiper_attack
Source reliability
C
Info credibility
3
Event time
Dec 1, 2025, 00:00 UTC
Event time confidence
unknown
Location
Cyberspace
Primary actor
Sandworm
Country
Poland
Countries
Poland
Tags
Sandworm, GRU, Russia, Poland, Power grid, DynoWiper, cyberattacks, Critical infrastructure, Wiper malware, NATO, Espionage, Renewable energy, Eastern Flank Deterrence
Nodes
Node 1: Borders