The 2025 cyberattacks on Poland's water treatment plants represent a significant escalation in hybrid warfare targeting critical infrastructure. Attackers linked to Russian APT28, APT29, and Belarusian UNC1151 exploited basic cybersecurity weaknesses — weak or default passwords and publicly exposed ICS management interfaces like HMIs and remote desktop protocols — to gain unauthorized control. This allowed the manipulation of operational parameters of essential water supply equipment, such as pumps and alarms, directly threatening public safety and water continuity. Despite the absence of advanced malware or zero-day exploits, the incidents demonstrate the severe risks posed by poor OT/ICS cyber hygiene. Attribution is supported by ABW investigations and corroborated by multiple reputable open sources, though no direct malware signatures or unique technical indicators were found. The attack aligns with a broader campaign of Russian and Belarusian cyber hybrid warfare against NATO/EU critical infrastructure. Immediate mitigation recommendations emphasize eliminating open internet access to ICS interfaces, enforcing strong authentication, segmenting networks, and improving monitoring to prevent similar breaches.

The 2025 cyberattacks on Poland's water treatment plants represent a significant escalation in hybrid warfare targeting critical infrastructure. Attackers linked to Russian APT28, APT29, and Belarusian UNC1151 exploited basic cybersecurity weaknesses — weak or default passwords and publicly exposed ICS management interfaces like HMIs and remote desktop protocols — to gain unauthorized control. This allowed the manipulation of operational parameters of essential water supply equipment, such as pumps and alarms, directly threatening public safety and water continuity. Despite the absence of advanced malware or zero-day exploits, the incidents demonstrate the severe risks posed by poor OT/ICS cyber hygiene. Attribution is supported by ABW investigations and corroborated by multiple reputable open sources, though no direct malware signatures or unique technical indicators were found. The attack aligns with a broader campaign of Russian and Belarusian cyber hybrid warfare against NATO/EU critical infrastructure. Immediate mitigation recommendations emphasize eliminating open internet access to ICS interfaces, enforcing strong authentication, segmenting networks, and improving monitoring to prevent similar breaches.