Coordinated Destructive Cyberattacks Target Polish Energy Sector on 29 December 2025

On 29 December 2025, during morning and afternoon hours, coordinated cyberattacks targeted over 30 wind and photovoltaic farms, a private manufacturing company, and a large combined heat and power plant in Poland supplying heat to nearly half a million customers. The attacks had a purely destructive intent, involving damaging firmware, deleting system files, and deploying wiper malware affecting both IT systems and industrial physical devices. Attacks on renewable energy grid connection points disrupted communication with the distribution system operator but did not halt electricity production. The heat and power plant attack aimed at irreversible data destruction but was thwarted by EDR software. The manufacturing sector attack used identical wiper malware but was considered opportunistic and unrelated to energy sector goals. Attribution links the attack infrastructure to a known advanced persistent threat actor cluster known as “Static Tundra,” also called “Berserk Bear,” “Ghost Blizzard,” and “Dragonfly,” marking their first publicly described destructive activity. CERT Polska published a detailed technical report analyzing the malware and attacker tactics, emphasizing this represents a significant escalation in cyber sabotage risks to Poland's critical energy infrastructure.